changed 4 years ago  
Linked with GitHub

totolink vulnerability

vendor:TOTOLINK

product:A720R;

version:A720R_Firmware(V4.1.5cu.470_B20200911)

type:Remote Command Execution

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng

institution:potatso@scnu、feng@scnu、eifiz@scnu

Vulnerability description

We found an Command Injection vulnerability and buffer overflow vulnerability in TOTOLINK Technology router with firmware which was released recently，allows remote attackers to execute arbitrary OS commands from a crafted request.

Remote Command Injection vulnerability

In this function,ip is directly passed by the attacker, so we can control the ip to attack the OS.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

PoC

Remote Command Injection

We set the value of ip as -h\nping 1.1.1.1\n and the router will excute ping command,such as:

POST http://example.com/cgi-bin/cstecgi.cgi?action=s

{"topicurl":"setDiagnosisCfg","ip":"-h\nping 1.1.1.1\n","num":"500"}
Select a repo