Command Injection Vulnerability in Motorola Devices

CVE-2019-9120

Summary

A command injection vulnerability has been identified in Motorola C1 and M2 devices running specific firmware versions. This flaw allows an unauthenticated remote attacker to execute arbitrary commands by leveraging a specially crafted HNAP API request. Specifically, the vulnerability is triggered through the SetWLanACLSettings API function, which processes untrusted input, leading to potential exploitation via shell metacharacters located in the wl(0).(0)_maclist field. Successful exploitation can result in obtaining a root shell on the affected devices, posing severe security risks.

References