Attack Chain

1. Attacker establishes an authenticated administrative session on the LAN.
2. Attacker triggers the VPN client import functionality on the router.
3. Attacker submits a crafted OpenVPN profile description containing a payload using backticks and ${IFS} to bypass input filtering (e.g., `sleep${IFS}1`).
4. The router stores the malicious string as a filename in /etc/openvpn/.ovpn.
5. The application writes the path to /tmp/ovpn_curr_edit.
6. The web server executes grep and sed commands using the unquoted path from /tmp/ovpn_curr_edit.
7. The system shell interprets the injected backticks as commands, executing the payload with root privileges.

Impact

Successful exploitation allows for full command execution on the router as the root user, potentially leading to a complete compromise of the network device.

Recommendation

• Update Archer AX17 v1 firmware to version 1.5.0 Build 20260605 or later.
• Limit administrative access to the router web interface to trusted management subnets or hardened endpoints to mitigate the risk of an attacker gaining the required administrative session.
• Audit logs for unexpected administrative logins or configuration changes on network devices.