A critical command injection vulnerability in multiple WAYOS router models exposes devices to remote unauthorized command execution.

The vulnerability exists in the /usb_paswd.asp script, where the Name parameter fails to properly sanitize user input, leading to command injection. This flaw is remotely exploitable by unauthenticated attackers.

Successful exploitation allows an attacker to execute arbitrary commands on the affected router with the privileges of the web server. This could lead to full device compromise, unauthorized access to internal network traffic, or the redirection of traffic for malicious purposes. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality.

Immediate Action: Restrict access to the web management interface of the affected devices and monitor for official vendor firmware updates.

Proactive Monitoring: Review system logs for suspicious activity involving the /usb_paswd.asp file and monitor network traffic for unexpected outbound connections from the router.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering rules to block requests directed at the /usb_paswd.asp endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced security research (VulDB).

Organizations utilizing the identified WAYOS router models must treat this vulnerability with high urgency. Given the availability of a public proof-of-concept and the potential for remote command execution, network administrators should isolate these devices from the public internet immediately and apply vendor-provided patches as soon as they become available.