The KuWFi 4G AC900 LTE router contains a critical command injection vulnerability that allows an authenticated attacker to achieve full system compromise.

This is a command injection vulnerability occurring within the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can inject shell metacharacters into the pincode or cmds parameters to execute arbitrary OS commands with root-level privileges.

Successful exploitation of this vulnerability results in full system compromise, granting an attacker complete control over the affected network hardware. Given the CVSS score of 8.8, this poses a significant risk to organizational security, as it allows for persistent unauthorized access, lateral movement within the network, and the potential for enabling remote backdoors such as telnet.

Immediate Action: Contact the vendor or monitor official support channels for a firmware update addressing this injection flaw, as no patch is currently confirmed.

Proactive Monitoring: Review device access logs for suspicious HTTP requests targeting the /goform/ directory, particularly those containing shell metacharacters or unauthorized configuration changes.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses only, and utilize a network firewall to block unauthorized access to the affected API endpoints.

Public Exploit Available: Yes — a technical write-up and proof-of-concept are available via the referenced GitHub repository.

Due to the severity of this command injection flaw and the potential for total device takeover, administrators should restrict network access to the router management interface immediately. While awaiting a vendor-supplied firmware update, ensure that the device is isolated from untrusted networks to prevent exploitation by malicious actors.