CVE-2025-29534

CVE-2025-29534

CVE-2025-29534: Authenticated RCE in PowerStick Wave Dual-Band WiFi Extender

[Product]
PowerStick Wave Dual-Band WiFi Extender V1.0

[Version]
V1.0

[Affected Component]
/etc/nginx/cgi-bin/cgi_vista.cgi

[Description]
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band WiFi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges due to insufficient sanitization of user-supplied input in /cgi-bin/cgi_vista.cgi.

[Impact]
- Full device compromise, enabling network traffic interception, malware deployment, or use as a botnet node.
- CVSS v3.1 Score: 8.9 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

[Mitigation]
- Change the default admin password to a strong, unique password.
- Replace the device with a more secure alternative.
- Update firmware if a patch is released.

[Steps to Reproduce]
1. Authenticate to the device’s web interface (e.g., http://192.168.11.1 or http://setup.wave.net) with valid credentials.
2. Send a crafted HTTP POST request to http://192.168.11.1/cgi-bin/cgi_vista.cgi with a malicious time_zone parameter (e.g., ';<command>') in the JSON payload for command ID 55 (NTP settings).

[Reference]
https://medium.com/@emptyex3/hunting-cves-in-iot-devices-a-wi-fi-extender-walkthrough-ea09b0afd90d