| Titre | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 Mini (tomato-K26-1.28.RT-MIPSR2-124-Mini.trx, build5x-124-EN, 2014-12-24). Verified on research sample OS Command Injection (CWE-78, post-authentication) |
|---|
| Description | The router service binary /sbin/rc reads administrator-writable NVRAM key ppp_custom in function sub_40F88C (offset 0x40F88C). The value is written via fprintf("%s\n", value) at 0x40FD54 without sanitization into pppd options file /tmp/ppp/wanoptions. Called by start_l2tp, start_pppoe, and start_pptp — all three PPP WAN types.
pppd 2.4.5 (bundled) supports the pty option, which executes its argument via execl("/bin/sh", "sh", "-c", command) as root. An authenticated web administrator can set ppp_custom to pty "/bin/sh -c arbitrary_command" for root RCE on PPP connect.
Phase A (file injection) dynamically verified: QEMU MIPS + bwrap + LD_PRELOAD; /tmp/ppp/wanoptions last line contains pty payload; strace confirms mkdir/symlinks/write(260). Phase B (pppd pty execution) requires real device (pppd needs root; blocked in qemu-usermode). |
|---|
| La source | ⚠️ https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/03-sub_40F88C-pppd.md |
|---|
| Utilisateur | WH-YHUST (UID 98329) |
|---|
| Soumission | 19/06/2026 11:57 (il y a 2 mois) |
|---|
| Modérer | 06/08/2026 07:47 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 386455 [Shibby Tomato 1.28.0000 /tmp/ppp/wanoptions sub_40F88C ppp_custom élévation de privilèges] |
|---|
| Points | 20 |
|---|