Remote Code Execution in Netlink ICT HG323RW Routers via CVE-2026-96515

CVE-2026-96515 is a high-severity security vulnerability affecting Netlink ICT HG323RW routers, specifically firmware version 3.1.02-260228. The issue stems from the device's diagnostic import handler, hosted at the /boaform/formImportOMCIShell endpoint, which fails to correctly validate user-supplied files. An attacker with a low-privileged, authenticated web account on an adjacent network can upload a crafted shell script that is subsequently executed by the BOA process with root (UID 0) privileges. This vulnerability, identified as CWE-862 (Missing Authorization) and CWE-434 (Unrestricted Upload of File with Dangerous Type), was reported by Muhammed Safvan and acknowledged by CERT-In in advisory CIVN-2026-0473. With the recent publication of a functional proof-of-concept exploit, the risk of exploitation has increased significantly for unpatched devices. Defenders should ensure all affected hardware is updated to firmware version 3.1.02-260904, which removes the vulnerable endpoints.

Attack Chain

1. Attacker gains access to a low-privileged web account on the Netlink ICT HG323RW router, potentially via factory default credentials or credential harvesting.
2. Attacker establishes a connection to the router's web interface from an adjacent network segment.
3. Attacker authenticates to the web portal and obtains necessary session/CSRF tokens to authorize subsequent API requests.
4. Attacker crafts a multipart HTTP POST request containing a malicious shell script payload, targeting the /boaform/formImportOMCIShell endpoint and the binary field.
5. Attacker transmits the multipart request to the target router, triggering the file upload mechanism.
6. The bin/boa process on the router saves the uploaded content to /tmp/omcishell without proper sanitization.
7. The system's diagnostic handler invokes the execution sink, resulting in /bin/sh /tmp/omcishell being executed with UID 0.
8. Attacker gains a reverse shell or arbitrary command execution as the root user, facilitating full system control.

Impact

Successful exploitation allows an attacker to gain full control over the affected Netlink ICT HG323RW router with root-level privileges. This enables the attacker to intercept network traffic, modify device configurations, establish persistent backdoors, or use the device as a pivot point for further lateral movement within the private network. Given the device's role as a network gateway, this represents a significant compromise of the local infrastructure.

Recommendation

• Upgrade all Netlink ICT HG323RW routers to firmware version 3.1.02-260904 immediately, as this version disables the vulnerable /boaform/formImportOMCIShell endpoint.
• Restrict administrative web access to the router to trusted management VLANs or internal-only interfaces.
• Change default factory credentials and enforce strong, unique passwords for all user accounts, including low-privileged ones.
• Monitor internal network traffic for unexpected HTTP POST requests directed toward /boaform/formImportOMCIShell or /boaform/admin/formImportOMCIShell.
• Audit for any unexplained processes spawned from /tmp/ directory files, specifically those executing via /bin/sh or /bin/bash with UID 0.