The article seems to imply this is a malicious tool, but it seems more likely to me that this is just another poorly designed router instead.
That original research only looked at one Wavlink router. This is the extended research with the help of two other researchers. And of course the attempted exploit from a malicious IP address which was detected only recently
This comment I'm replying to, though... you don't need to do this. If it had been the only reply you posted, I would have come away from our exchange with a very different opinion of you, and that would've been a bit unfair. Just something to think about for the future.
There's no mention if this is vulnerable to XSS which is the more interesting issue.
Not to knock the researcher's work too much, but what he did was what people installing OpenWRT on devices have been doing for 15 years, and what he found is pretty typical. Except for the password in JS. That was just weird.
>So what does that get us from the perspective of a remote attacker? We have the ability to get the current admin credentials, and we can get a shell if the telnet binary is started. However, most remote attackers wont be able to solder on any wires, so I wasn’t going to stop there.
>Going through the rest of the pages in the www directory, there is another web page that provides this interface:
So you don't need telnet, but the creds being on the page + knowledge of the system command page would be enough to do whatever you wanted.
Also see this follow-up research page on the same devices:
https://james-clee.com/2020/04/23/more-information-disclosur...
>Just a reminder – every screenshot below is of a web page that is externally accessible without requiring authentication and contains sensitive data.
But who is "you" here? Are you assuming the attacker needs to be physically present on your network? can any malicious script running on browser's victim make an xhr request to "192.168.0.1/page-which-exposes-password"?
> a remote attacker can achieve RCE via a POST request to adm.cgi. There are several conditions required, including proper parameters and an active session. However, these conditions can all be met without any initial authentication required thanks to several specific exposed “live_(string).shtml” endpoints – so an attacker with the right background information about the device could achieve RCE fairly easily.
Anyway, back then, a lot of these devices had really bad security. Some where so bad that you could do an XSS attack that gains root access to someone's router. Someone could definitely have intentionally added a backdoor, but I agree that it's pretty likely that developers working on a router with the goal of being cheap were lazy, rushed, or just didn't care, and left development backdoor open, allowed admin access on LAN and WAN, or something else.
[1] https://cybernews.com/security/walmart-exclusive-routers-oth...
"The Jetstream and Wavlink routers showcase a simple GUI (or user-friendly interface) for its backdoors that is different from the interface presented to router admins."