A serious vulnerability has been discovered in the MeiG Smart FORGE_SLT711, a 4G LTE CPE router. The flaw allows unauthenticated attackers to execute operating system commands with root privileges — no password or login required.
The issue lives in the GoAhead web server’s /action/SetRemoteAccessCfg endpoint. The router takes a JSON “password” field and passes it directly into a system call via sprintf. An attacker can inject arbitrary commands by wrapping them in $(...). Because the endpoint isn’t listed in the router’s authentication table, nobody checks whether the request is legitimate.
What makes this especially nasty: the attack is blind. Output doesn’t come back in the HTTP response, so testers need to redirect results to a file and retrieve them separately. Still, full root access on a network device is about as bad as it gets.
The vulnerability affects firmware version MDM9607.LE.1.0-00110-STD.PROD-1, and likely all firmware versions in this product line. The device runs Linux 3.18.48 on a Qualcomm MDM9607 chipset.
