Attack Chain

1. The attacker identifies an internet-facing Baicells EG3661M device running the vulnerable firmware.
2. The attacker navigates to the management interface hosted on the device.
3. The attacker prepares a crafted HTTP request targeting the /cgi-bin/luci endpoint.
4. The attacker injects malicious shell metacharacters into one of the vulnerable parameters: MaxHops, Timeout, or Size.
5. The web server process, executing with elevated privileges, improperly sanitizes the input before passing it to a system call.
6. The injected OS command is executed by the router's underlying operating system.
7. The attacker achieves persistent remote command execution to perform further malicious actions, such as configuration modification or credential theft.

Impact

Successful exploitation results in full control over the affected Baicells EG3661M device. Given that these are routing and networking appliances, impact includes potential interception of network traffic, device bricking, or utilization of the router as a pivot point within the local network.

Recommendation

Prioritize the isolation of the management interface of all Baicells EG3661M devices from the public internet. Ensure the management interface is only accessible via a secure, private network or VPN. Since the vendor has not provided a patch, consider upgrading to an alternative hardware solution or strictly enforcing access control lists (ACLs) to restrict access to the /cgi-bin/luci endpoint.