| Título | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Descripción | setLanguageCfg switches the web interface language. It is implemented in lib/cste_modules/global.so and dispatched by bin/cste_sub from the topic totolink/router/global/setLanguageCfg. The handler reads the language identifier with websGetVar(a2, "langType", ""), stores it in the MIB with apmib_set(6002, Var), and then uses it to build two paths: sprintf(s, "/web_cste/js/language_%s.js", Var) and sprintf(s, "ln -s /web_cste/js/language_%s.js /web_cste/js/language.js 1>/dev/null 2>&1", Var). The second string is passed to CsteSystem(s, 0). The value is neither validated nor quoted, so a semicolon in langType terminates the ln command and starts an attacker-chosen one: the payload x.js;id; produces the command line ln -s /web_cste/js/language_x.js;id;.js /web_cste/js/language.js 1>/dev/null 2>&1, in which ln fails harmlessly and id executes as root. Validity_check is not called by this handler, so the full shell metacharacter set is available, including the pipe, the backtick, the dollar sign and the slash, which means arbitrary commands and arbitrary file writes are both possible. A particularly useful variant is to point the language symlink at a file of the attacker's choosing, because the handler removes /web_cste/js/language.js first and then creates the link, so the value influences which script the web interface loads. The same parameter also overflows the 256-byte command buffer, which is a separate defect. |
|---|
| Fuente | ⚠️ https://gist.github.com/H3rmesk1t/dd1654114ee1d450620fcad0e25577af |
|---|
| Usuario | H3rmesk1t (UID 70306) |
|---|
| Sumisión | 2026-10-09 08:24 (hace 13 días) |
|---|
| Moderación | 2026-10-21 20:17 (12 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 195145 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setLanguageCfg langType escalada de privilegios] |
|---|
| Puntos | 0 |
|---|