CVE-2022-25916 (JSON, published 2023-02-01T05:15Z)
Description: value: Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. 
Severity: nan (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/simenkid/mt7688-wiscan
Files changed:
README.md
index.js
package.json
Commit message: v0.8.3 intf only accetps alphabets and numbers


Vulnerable code:
1. [Overiew](#Overiew)    
2. [Installation](#Installation) 
**mt7688-wiscan** is a wifi access points scanning tool which is running with node.js on MediaTek Linkit Smart 7688. This tool provides three APIs [lqi()](#API_lqi), [scan()](#API_scan), and [scanByEssid()](#API_scanByEssid) that help you with getting link quality indicator (LQI) to an specific AP, scanning neighbor wifi APs, and scanning a specific AP with its **essid**.  
I am using this tool on machine nodes in my LWM2M IoT project. On each machine, there is a panel to show some information about the machine and to show LQI between machine and its router as well.  
  
********************************************
Query the LQI (link quality indicator) between your Linkit Smart 7688(in station mode) and its router(AP).  
**Arguments:**  
1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.  
2. `essid` (_String_): The ESSID of the AP to scan for.  
3. `callback` (_Function_): `function(err, result) { ... }`. The `result` is a number between 0 and 100 to indicate the relative link quality between the station and access point. The value is bigger to show better link quality. If given 'essid' is not found after scan, `result` will be `null`.  
  
  
* It takes around 5 seconds to accomplish a single scan.  
* If you've changed the name of radio interface with OpenWrt configuration tool, you should give this method with the correct interface name, for example, `'myradio'`.  
* You can also try this tool on other platforms, but be aware of that the radio interface name is subject to platforms. Use `iwconfig` command at console to get some hints.  
  
**Returns:**  
  
* _none_
**Examples:**  
  
    if (err)
        console.log(err);       // null
    else
        console.log(result);    // 78
    if (err)
        console.log(err);       // null
    else
        console.log(result);    // null
    if (err)
        console.log(err);       // null
    else
        console.log(result);    // 82
    if (err)
        console.log(err);       // [Error: No such wireless device: bad_ra]

********************************************
Scan neighbor wifi access points.  
**Arguments:**  
1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.  
{ 
  
**Returns:**  
  
* _none_
**Examples:**  
  
    console.log(result);

    // [
    //     { address: 'D8:FE:E3:E5:9F:3B',  essid: 'sivann', ...   },
    //     { address: '20:0C:C8:01:1D:98',  essid: 'delta_01', ... },
    //     { address: '9C:D6:43:01:7E:C7',  essid: 'AVIS', ...     },
    //     ...
    // ]
    console.log(result);
    console.log(err);   // [Error: No such wireless device: foo]
********************************************
Scan for a specific AP with its essid.  
**Arguments:**  
1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.  
2. `essid` (_String_): The ESSID of the AP to scan for.  
3. `callback` (_Function_): `function(err, result) { ... }`. The result is a report object, otherwise `null` if not found.  
**Examples:**  
  
    console.log(result);

    // { 
    //     address: 'D8:FE:E3:E5:9F:3B',
    //     essid: 'sivann',
    //     mode: 'Master',
    //     channel: 1,
    //     frequency: '2.412 GHz',
    //     signal: -256,
    //     quality: 68,
    //     encryption: 'WPA2 PSK (AES-OCB)' // String
    // }
    console.log(result);    // null
    freqs = [ '2.412', '2.417', '2.422', '2.427', '2.432', '2.437', '2.442', '2.447', '2.452', '2.457', '2.462' ];
    var child;
    if (typeof intf === 'function') {
        callback = intf;
        intf = defaultInterface;
    }
    intf = intf || defaultInterface;
    callback = callback || function () {};
    if (typeof intf !== 'string')
        return callback(new Error('intf should be a string.'));
    child = exec('iwinfo ' + intf + ' scan', function (error, stdout, stderr) {
        if (error) {
            stderr = stderr.trim();
            return callback(new Error(stderr));
        }
        var info = stdout,
            parsed = [];

        info = info.replace(/\n/g, ' ');
        info = info.replace(/"/g, '');
        info = info.split(' ');
        info.forEach(function (char, i) {
            if (char === 'ESSID' && info[i+1] === '')
                info[i+1] = 'unknown';
            else if (char !== '')
                parsed.push(char);
        });

        parsed = parse(parsed);
        callback(null, parsed);
    var target = null;
    if (arguments.length === 2) {
        callback = essid;
        essid = intf;
        intf = defaultInterface;
    }
    intf = intf || defaultInterface;
    if (typeof intf !== 'string')
        return callback(new Error('intf should be a string.'));
    else if (typeof essid !== 'string')
        return callback(new Error('essid should be a string.'));
    callback = callback || function () {};
    wiscan.scan(intf, function (err, infos) {
        if (err)
            return callback(err);
        infos.forEach(function (info) {
            if (info.essid === essid)
                target = info;
        });

        callback(null, target);
    if (arguments.length === 2) {
        callback = essid;
        essid = intf;
        intf = defaultInterface;
    }
    intf = intf || defaultInterface;
    wiscan.scanByEssid(intf, essid, function (err, info) {
        if (err)
            return callback(err);
        if (info)
            callback(null, info.quality);
        else
            callback(null, null);
    });
    var parsed = [],
        len = items.length,
        idx = 0;

    if (items.length === 0)
        return parsed;

    items.forEach(function (c, i) {
        var val;
        if (c === 'Cell') {
            //- [deleted: need not cell field] val = items[i+1];
            //- [deleted: need not cell field] val = isNaN(parseInt(val)) ? val : parseInt(val);
            parsed.push({});
        } else if (c === 'Address:') {
            parsed[idx].address = items[i+1];
        } else if (c === 'ESSID:') {
            parsed[idx].essid = items[i+1];
        } else if (c === 'Mode:') {
            parsed[idx].mode = items[i+1];
        } else if (c === 'Channel:') {
            val = items[i+1];
            val = isNaN(parseInt(val)) ? val : parseInt(val);
            parsed[idx].channel = val;
            parsed[idx].frequency = getFrequency(val);
        } else if (c === 'Signal:') {
            val = items[i+1];
            val = isNaN(parseInt(val)) ? val : parseInt(val);
            parsed[idx].signal = val;
        } else if (c === 'Quality:') {

            val = items[i+1].split('/')[0];
            val = isNaN(parseInt(val)) ? val : parseInt(val);
            parsed[idx].quality = val;
        } else if (c === 'Encryption:') {
            var x = i + 1,
                enc = '';

            while (items[x] !== 'Cell') {
                if (x !== len) {
                    enc = enc + items[x] + ' ';
                    x += 1;
                } else {
                    break;
                }
            }
            enc = enc.trim();
            parsed[idx].encryption = enc;
            idx += 1;
    });
    return parsed;
    var f = freqs[ch - 1];
    if (f)
        f = f + ' GHz';
    else
        f = '';
    return f;
  "version": "0.8.2",

Fixed code:
1. [Overiew](#Overiew)
2. [Installation](#Installation)

**mt7688-wiscan** is a wifi access points scanning tool which is running with node.js on MediaTek Linkit Smart 7688. This tool provides three APIs [lqi()](#API_lqi), [scan()](#API_scan), and [scanByEssid()](#API_scanByEssid) that help you with getting link quality indicator (LQI) to an specific AP, scanning neighbor wifi APs, and scanning a specific AP with its **essid**.
I am using this tool on machine nodes in my LWM2M IoT project. On each machine, there is a panel to show some information about the machine and to show LQI between machine and its router as well.



---


Query the LQI (link quality indicator) between your Linkit Smart 7688(in station mode) and its router(AP).

**Arguments:**

1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.
2. `essid` (_String_): The ESSID of the AP to scan for.
3. `callback` (_Function_): `function(err, result) { ... }`. The `result` is a number between 0 and 100 to indicate the relative link quality between the station and access point. The value is bigger to show better link quality. If given 'essid' is not found after scan, `result` will be `null`.
- It takes around 5 seconds to accomplish a single scan.
- If you've changed the name of radio interface with OpenWrt configuration tool, you should give this method with the correct interface name, for example, `'myradio'`.
- You can also try this tool on other platforms, but be aware of that the radio interface name is subject to platforms. Use `iwconfig` command at console to get some hints.

**Returns:**

- _none_

**Examples:**

  if (err) console.log(err); // null
  else console.log(result); // 78
  if (err) console.log(err); // null
  else console.log(result); // null
  if (err) console.log(err); // null
  else console.log(result); // 82
  if (err) console.log(err); // [Error: No such wireless device: bad_ra]
---

Scan neighbor wifi access points.

**Arguments:**
1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.
{
**Returns:**

- _none_

**Examples:**

  console.log(result);

  // [
  //     { address: 'D8:FE:E3:E5:9F:3B',  essid: 'sivann', ...   },
  //     { address: '20:0C:C8:01:1D:98',  essid: 'delta_01', ... },
  //     { address: '9C:D6:43:01:7E:C7',  essid: 'AVIS', ...     },
  //     ...
  // ]
  console.log(result);
  console.log(err); // [Error: No such wireless device: foo]
---

Scan for a specific AP with its essid.
**Arguments:**

1. `intf` (_String_, optional): A default value of `'ra0'` will be used if not given.
2. `essid` (_String_): The ESSID of the AP to scan for.
3. `callback` (_Function_): `function(err, result) { ... }`. The result is a report object, otherwise `null` if not found.
**Examples:**

  console.log(result);

  // {
  //     address: 'D8:FE:E3:E5:9F:3B',
  //     essid: 'sivann',
  //     mode: 'Master',
  //     channel: 1,
  //     frequency: '2.412 GHz',
  //     signal: -256,
  //     quality: 68,
  //     encryption: 'WPA2 PSK (AES-OCB)' // String
  // }
  console.log(result); // null

  freqs = [
    '2.412',
    '2.417',
    '2.422',
    '2.427',
    '2.432',
    '2.437',
    '2.442',
    '2.447',
    '2.452',
    '2.457',
    '2.462',
  ];
  var child;
  if (typeof intf === 'function') {
    callback = intf;
    intf = defaultInterface;
  }
  intf = intf || defaultInterface;
  callback = callback || function () {};
  if (typeof intf !== 'string')
    return callback(new Error('intf should be a string.'));
  if (!/[0-9a-zA-Z]/.test(intf.charAt(0)))
    return callback(new Error('Bad intf.'));

  child = exec('iwinfo ' + intf + ' scan', function (error, stdout, stderr) {
    if (error) {
      stderr = stderr.trim();
      return callback(new Error(stderr));
    }
    var info = stdout,
      parsed = [];

    info = info.replace(/\n/g, ' ');
    info = info.replace(/"/g, '');
    info = info.split(' ');
    info.forEach(function (char, i) {
      if (char === 'ESSID' && info[i + 1] === '') info[i + 1] = 'unknown';
      else if (char !== '') parsed.push(char);

    parsed = parse(parsed);
    callback(null, parsed);
  });
  var target = null;
  if (arguments.length === 2) {
    callback = essid;
    essid = intf;
    intf = defaultInterface;
  }
  intf = intf || defaultInterface;
  if (typeof intf !== 'string')
    return callback(new Error('intf should be a string.'));
  else if (typeof essid !== 'string')
    return callback(new Error('essid should be a string.'));
  callback = callback || function () {};
  wiscan.scan(intf, function (err, infos) {
    if (err) return callback(err);
    infos.forEach(function (info) {
      if (info.essid === essid) target = info;

    callback(null, target);
  });
  if (arguments.length === 2) {
    callback = essid;
    essid = intf;
    intf = defaultInterface;
  }
  intf = intf || defaultInterface;
  wiscan.scanByEssid(intf, essid, function (err, info) {
    if (err) return callback(err);
    if (info) callback(null, info.quality);
    else callback(null, null);
  });
  var parsed = [],
    len = items.length,
    idx = 0;

  if (items.length === 0) return parsed;

  items.forEach(function (c, i) {
    var val;
    if (c === 'Cell') {
      //- [deleted: need not cell field] val = items[i+1];
      //- [deleted: need not cell field] val = isNaN(parseInt(val)) ? val : parseInt(val);
      parsed.push({});
    } else if (c === 'Address:') {
      parsed[idx].address = items[i + 1];
    } else if (c === 'ESSID:') {
      parsed[idx].essid = items[i + 1];
    } else if (c === 'Mode:') {
      parsed[idx].mode = items[i + 1];
    } else if (c === 'Channel:') {
      val = items[i + 1];
      val = isNaN(parseInt(val)) ? val : parseInt(val);
      parsed[idx].channel = val;
      parsed[idx].frequency = getFrequency(val);
    } else if (c === 'Signal:') {
      val = items[i + 1];
      val = isNaN(parseInt(val)) ? val : parseInt(val);
      parsed[idx].signal = val;
    } else if (c === 'Quality:') {
      val = items[i + 1].split('/')[0];
      val = isNaN(parseInt(val)) ? val : parseInt(val);
      parsed[idx].quality = val;
    } else if (c === 'Encryption:') {
      var x = i + 1,
        enc = '';

      while (items[x] !== 'Cell') {
        if (x !== len) {
          enc = enc + items[x] + ' ';
          x += 1;
        } else {
          break;
      }
      enc = enc.trim();
      parsed[idx].encryption = enc;
      idx += 1;
    }
  });
  return parsed;
  var f = freqs[ch - 1];
  if (f) f = f + ' GHz';
  else f = '';
  return f;
  "version": "0.8.3",