| Título | TOTOLINK X5000R V9.1.0cu.2089_B20211224 Command Injection |
|---|
| Descripción | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the `cstecgi.cgi` component, specifically in the `exportOvpn` handler when processing the `filetype=gz` branch.
The handler parses the HTTP query string using `getNthValueSafe()`. When `type=user` is specified, the third `&`-delimited field is copied into an intermediate buffer and then parsed using `=`. The value after `=` is stored in `v49` without validation or shell escaping.
When the supplied field begins with `filetype=gz`, the handler enters the gzip export branch and constructs the following command:
`openvpn-cert build_user %s gz`
where `%s` is replaced directly by the attacker-controlled value in `v49`. The resulting command is then executed through `system()`.
For example, a crafted value such as `filetype=gz;ls;` causes the extracted value `gz;ls;` to be incorporated into the shell command, allowing shell metacharacters to terminate the intended command and execute an arbitrary command.
This vulnerability is reachable through the `exportOvpn` handler and allows an attacker to execute arbitrary operating-system commands with the privileges of the vulnerable CGI process.
|
|---|
| Fuente | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md |
|---|
| Usuario | awigwu76 (UID 91463) |
|---|
| Sumisión | 2026-08-17 11:02 (hace 29 días) |
|---|
| Moderación | 2026-09-15 11:03 (29 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 404082 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 Export Ovpn cstecgi.cgi?action=exportOvpn&type=user exportOvpn filetype escalada de privilegios] |
|---|
| Puntos | 20 |
|---|