# Hacking the Nokia Beacon 1 Router: UART, Command Injection, and Password Generation with Qiling

Nokia Beacon 1 troubleshooting CGI passes waninterfacename POST param to system() with a blacklist missing newline, enabling authenticated command injection.

- Payout: Research
- Severity: high
- Program: Nokia Beacon
- Write-up by: Eugene Lim
- Disclosed: 2025-10-13
- Write-up quality: 7/10
- Original: https://spaceraccoon.dev/nokia-beacon-router-uart-command-injection/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-nokia-beacon-router-uart-command-injection
- Tags: area:devices domain:iot domain:web impact:rce kind:research platform:research sev:high tech:linux technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:command-injection

**Target:** troubleshooting_web_app.cgi web endpoint on router
**Root cause:** waninterfacename POST parameter is validated by sub_14390 against a shell-metacharacter blacklist (byte_15A04) that omits newline (0x0A), then sprintf'd into an ifconfig command passed to system().
**Steps:**
1. Extract firmware from NAND dump (strip 64-byte OOB spare area every 2112 bytes) and binwalk/ubireader it.
2. Locate /web CGI binaries; grep for system/popen; find troubleshooting_web_app.cgi CGIMain reading CGIGetPost("waninterfacename").
3. Inspect sub_14390 blacklist byte_15A04; note 0x0A newline absent.
4. Send `POST /troubleshooting_web_app.cgi?ping` with body `wan_conlist=2&ipaddress=127.0.0.1&direction=rx&status=enable&domain=&wan_port=WAN&waninterfacename=ewan_1091_4_1%0awhoami%0a&portstatus=Disconnected&lan_port=null&csrf_token=...`
5. Observe command output appended to /tmp/Ifacedump.txt.
**How found:** After UART shell proved restricted (blacklist blocked breakouts, only <> redirects worked), pivoted to firmware static analysis: grepped CGI binaries for system/popen, found waninterfacename flowing into system(), then audited the sanitizer's blacklist and noticed newline was missing.
**Exploitation:** Authenticated attacker (with CSRF token) submits the crafted POST; newline breaks out of `ifconfig <iface> >> /tmp/Ifacedump.txt 2>&1`, executing arbitrary shell commands as the CGI process.
**Insight:** When a sanitizer is a fixed blacklist array, enumerate every byte it checks and diff against the full shell metacharacter set (newline, tab, $IFS, backticks) — a single missing byte like 0x0A re-enables injection.