| Titel | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection |
|---|
| Beschreibung | A vulnerability was found in Totolink A3300R 17.0.0cu.557_b20221024 . Affected by this vulnerability is the function sub_41F5D0 of the component cstecgi.cgi . The manipulation of the argument lanIp with an unknown input leads to a command injection vulnerability.We found a Command Injection vulnerability in shttpd , allows remote attackers to execute arbitrary OS commands from a crafted request.In sub_41F5D0 function, it reads in a user-provided parameter lanIp and passes its value to Uci_Set_Str function.However ,the value of the lanIp is inserted into v11 using snprintf,and the value of v11 will be handled by the function CsteSystem.Finally,the command will be executed by execv() in CsteSystem. |
|---|
| Quelle | ⚠️ https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_39/README.md |
|---|
| Benutzer | LtzHuster2 (UID 96397) |
|---|
| Einreichung | 13.03.2026 02:38 (vor 17 Tagen) |
|---|
| Moderieren | 29.03.2026 19:51 (17 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 354126 [Totolink A3300R 17.0.0cu.557_b20221024 Parameter /cgi-bin/cstecgi.cgi setLanCfg lanIp erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|