Attack Chain

1. Attacker gains access to a low-privileged web account on the Netlink ICT HG323RW router, potentially via factory default credentials or credential harvesting.
2. Attacker establishes a connection to the router's web interface from an adjacent network segment.
3. Attacker authenticates to the web portal and obtains necessary session/CSRF tokens to authorize subsequent API requests.
4. Attacker crafts a multipart HTTP POST request containing a malicious shell script payload, targeting the /boaform/formImportOMCIShell endpoint and the binary field.
5. Attacker transmits the multipart request to the target router, triggering the file upload mechanism.
6. The bin/boa process on the router saves the uploaded content to /tmp/omcishell without proper sanitization.
7. The system's diagnostic handler invokes the execution sink, resulting in /bin/sh /tmp/omcishell being executed with UID 0.
8. Attacker gains a reverse shell or arbitrary command execution as the root user, facilitating full system control.

Impact

Successful exploitation allows an attacker to gain full control over the affected Netlink ICT HG323RW router with root-level privileges. This enables the attacker to intercept network traffic, modify device configurations, establish persistent backdoors, or use the device as a pivot point for further lateral movement within the private network. Given the device's role as a network gateway, this represents a significant compromise of the local infrastructure.

Recommendation

• Upgrade all Netlink ICT HG323RW routers to firmware version 3.1.02-260904 immediately, as this version disables the vulnerable /boaform/formImportOMCIShell endpoint.
• Restrict administrative web access to the router to trusted management VLANs or internal-only interfaces.
• Change default factory credentials and enforce strong, unique passwords for all user accounts, including low-privileged ones.
• Monitor internal network traffic for unexpected HTTP POST requests directed toward /boaform/formImportOMCIShell or /boaform/admin/formImportOMCIShell.
• Audit for any unexplained processes spawned from /tmp/ directory files, specifically those executing via /bin/sh or /bin/bash with UID 0.