| Titel | Totolink EX1200L Firmware V9.3.5u.6146_B20201023 NULL Pointer Dereference |
|---|
| Beschreibung | A vulnerability was identified in TOTOLINK EX1200L firmware V9.3.5u.6146_B20201023 in the CGI program cstecgi.cgi, specifically in the code path selected by the JSON topic "setWizardCfg". The issue is caused by incomplete validation of expected wizard configuration fields before the resulting values are used by parameter-handling and string-processing logic.
The CGI endpoint /cgi-bin/cstecgi.cgi accepts JSON input and dispatches requests based on the "topicurl" field. When the value "setWizardCfg" is supplied, the program enters the wizard configuration handler and expects several additional configuration parameters to be present in the JSON body. If those parameters are omitted and the request body contains only {"topicurl":"setWizardCfg"}, the request is still accepted and processed rather than rejected.
Debugging of the affected firmware under qemu-mipsel confirmed that the malformed request reaches the normal parameter retrieval path involving websGetVar and cJSON_GetObjectItem. Because the expected wizard-related fields are missing, the handler continues with NULL-derived values. These values later propagate into string comparison logic, eventually causing a crash in libc's strcoll() function.
The issue was verified against the official firmware image V9.3.5u.6146_B20201023 using the extracted root filesystem as sysroot. Breakpoint-assisted GDB analysis showed that execution reaches both websGetVar and cJSON_GetObjectItem before the final fault. This confirms that the malformed request is not rejected at parse time and instead travels through the intended configuration-handling path until a NULL pointer is dereferenced.
The practical impact is denial of service of the affected CGI/web management component. The root cause is insufficient validation of JSON-derived wizard configuration values in the setWizardCfg handler, allowing NULL pointers to be used in later string operations. |
|---|
| Quelle | ⚠️ https://gist.github.com/wyxstarry/21e6c2853891a3beb140a7c879069f9f |
|---|
| Benutzer | yuxin_wang (UID 98928) |
|---|
| Einreichung | 01.07.2026 10:05 (vor 2 Monaten) |
|---|
| Moderieren | 17.08.2026 15:11 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 391273 [TOTOLINK EX1200L 9.3.5u.6146_B20201023 /cgi-bin/cstecgi.cgi setWizardCfg Denial of Service] |
|---|
| Punkte | 20 |
|---|