Submit #977220: TOTOLINK A3002MU V1.0.0-B20230403.1455 OS Command Injection

The targetAPSsid parameter of the /boafrm/formWsc handler of the TOTOLINK A3002MU is inserted into a shell command after passing through a sanitiser that is incomplete. The handler is entered by posting a non-empty triggerPIN field, and the relevant branch is taken when MIB entry 270 indicates that WPS is disabled, which is the factory default state. The value read from targetAPSsid is copied into a 128-byte stack buffer and passed to sub_42EFF8, which escapes only the backslash, the double quote and the backtick character. The dollar sign is deliberately left untouched, presumably because the surrounding command line is double quoted and the author expected the quoting to be sufficient. It is not: the value is formatted into iwpriv wlan%d set_mib wsc_specssid="%s", and inside double quotes /bin/sh still performs command substitution on $(...) and on backticks, so a value of the form $(cmd) executes cmd as root and substitutes its output into the argument. Because backticks are escaped by the sanitiser, the dollar-parenthesis form is the reliable choice for an attacker. The only constraint on the payload is a length check of the form strlen(targetAPSsid) < 0x21, which caps the parameter at 32 bytes; that is ample for a payload such as $(echo pwned>/var/web/x) at 25 bytes, and because /var/web is the document root the output can be written to a file and retrieved over HTTP rather than being limited by the response body. The handler is reachable without credentials by virtue of A3002MU-AUTH-01, so the combination yields unauthenticated root command execution. This entry is reported separately from the sibling peerPin and localPin sinks because the root cause is different: here the flaw is an incomplete escaping routine rather than the total absence of one, and the correct fix is therefore to correct or replace the sanitiser rather than merely to introduce validation.

• Quelle: ⚠️ https://gist.github.com/H3rmesk1t/2db0de79d2a3bd9d3e1a7b2927c75a52
• Benutzer: H3rmesk1t (UID 70306)
• Einreichung: 14.09.2026 10:58 (vor 21 Tagen)
• Moderieren: 05.10.2026 00:18 (21 days later)
• Status: Duplikat
• VulDB Eintrag: 407552 [Totolink A3002MU Hh-B20211125.1046 /boafrm/formWsc localPin erweiterte Rechte]
• Punkte: 0