| Título | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Descripción | setWebWlanIdx records which radio the web interface is currently configuring. It is implemented in lib/cste_modules/wireless.so and dispatched by bin/cste_sub from the topic totolink/router/wireless/setWebWlanIdx. The handler is one of the shortest in the firmware: it reads the index with websGetVar(a2, "webWlanIdx", "0"), interpolates it into sprintf(s, "echo %s > /tmp/webWlanIdx", Var) and calls CsteSystem(s, 0). There is no validation, no quoting and no length check of any kind, so a semicolon in the parameter terminates the echo command and starts an attacker-chosen one: the payload 0;id; produces the command line echo 0;id; > /tmp/webWlanIdx, in which echo 0 is harmless, id executes as root and the redirect applies only to the empty last command. Validity_check is not called by this handler, so the full shell metacharacter set is available. Because the destination of the redirect is a fixed path in /tmp, the handler is also a convenient way to overwrite a file that other components read: the value controls the content of /tmp/webWlanIdx and, through command substitution or a second redirect, any other path. The same parameter also overflows the 36-byte command buffer, which is a separate defect. |
|---|
| Fuente | ⚠️ https://gist.github.com/H3rmesk1t/0a15586d0acb489d1ad69357a296c795 |
|---|
| Usuario | H3rmesk1t (UID 70306) |
|---|
| Sumisión | 2026-10-09 08:25 (hace 13 días) |
|---|
| Moderación | 2026-10-21 20:18 (12 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 195147 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setWebWlanIdx webWlanIdx escalada de privilegios] |
|---|
| Puntos | 0 |
|---|