Enviar #1021293: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection

setUpgradeFW applies a firmware image that has already been uploaded to the device. It is implemented in lib/cste_modules/upgrade.so and dispatched by bin/cste_sub from the topic totolink/router/upgrade/setUpgradeFW. The handler reads the file name with websGetVar(a2, "FileName", "") and interpolates it into a shell command with sprintf(s, "rm -f %s 1>/dev/null 2>&1", filename) followed by CsteSystem(s, 0). The value is never validated, never quoted and never escaped, so any shell metacharacter in FileName is interpreted by /bin/sh running as root. Two independent copies of the pattern exist in the function and both are reachable: the first at 0x4B5C on the success path, after the image has passed the vendor, CSID and MD5 checks, and the second at 0x506C on the error path, which is taken whenever the declared ContentLength is smaller than 1000 bytes. The error path is the practical trigger, because it requires nothing but a syntactically valid request: the handler rejects the size, prints the failure response and then still builds and executes the rm -f command with the attacker's string. Because Validity_check is not called anywhere in this handler, the full shell metacharacter set is available, including the semicolon, the pipe and the backtick, so a payload such as ";id;" or ";cp /etc/shadow /web_cste/x;" executes with the privileges of the daemon. The output of the command is not returned in the response, but the device provides several channels that make the injection observable, including writing into the web root and reading the file back over HTTP.

• Fuente: ⚠️ https://gist.github.com/H3rmesk1t/f4bf7f53a87c3b5adb240db2dde12189
• Usuario: H3rmesk1t (UID 70306)
• Sumisión: 2026-10-09 08:18 (hace 14 días)
• Moderación: 2026-10-21 20:16 (12 days later)
• Estado: Duplicado
• Entrada de VulDB: 195149 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setUpgradeFW FileName escalada de privilegios]
• Puntos: 0