Submit #977218: TOTOLINK A3002MU V1.0.0-B20230403.1455 OS Command Injection

The WPS configuration handler of the TOTOLINK A3002MU passes the peerPin request parameter directly into a shell command that is executed with system() as root. The handler is selected by posting to /boafrm/formWsc with a non-empty setPIN field; it then reads peerPin through the generic parameter getter sub_4101C8, which applies a 4096-byte upper bound and performs URL decoding but no character filtering whatsoever. The value is formatted into the command template echo %s > /var/wps_peer_pin and the resulting string is passed to system(). Because the template is produced by snprintf rather than by a shell-quoting routine, any shell metacharacter supplied in peerPin is interpreted by /bin/sh: a semicolon, a pipe, an ampersand or a command substitution all execute as root in the context of the web server. The only additional condition is that MIB entry 271, which records the WPS configuration method, must equal 2; that state is reachable by posting WpsMethodDisable=ON to the same handler, and the write is performed with apmib_set(271, &n3) at 0x447CD8 before the value 2 is stored. Since request dispatch is itself unauthenticated, as documented in A3002MU-AUTH-01, an attacker on the network requires no credentials to reach the sink, and the resulting execution context is a root shell on the device. The template also gives the attacker a convenient exfiltration channel: because /var/web is the Boa document root, a payload that redirects command output into a file under that directory can be retrieved over unauthenticated HTTP, which removes any dependence on the response body of the triggering request.

• Quelle: ⚠️ https://gist.github.com/H3rmesk1t/b15720440179077fb761cdc1b841e577
• Benutzer: H3rmesk1t (UID 70306)
• Einreichung: 14.09.2026 10:57 (vor 21 Tagen)
• Moderieren: 05.10.2026 00:17 (21 days later)
• Status: Duplikat
• VulDB Eintrag: 407552 [Totolink A3002MU Hh-B20211125.1046 /boafrm/formWsc localPin erweiterte Rechte]
• Punkte: 0