| शीर्षक | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| विवरण | The WAN configuration handler setWanCfg selects a configuration branch from the proto field of the JSON request body. In the branch that configures the DHCP client it reads the hostName field and, after storing it into the device configuration, composes the shell string echo '<hostName>' > /proc/sys/kernel/hostname. The value is wrapped in single quotes in the format string but is not escaped, so a single quote inside the value terminates the quoted region and allows an arbitrary command to be inserted. The composed string is executed through doSystem, which formats the result into a 512-byte buffer with vsnprintf and passes it to system, and the web server runs as root. Because the value is stored into the main.hostname and wan.hostname configuration options before the command is composed, an attacker also leaves persistent configuration behind. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. The branch is selected by any proto value other than the explicit cases zero, three and four; the values one, two, five and nine were each confirmed to reach the vulnerable code. The result is arbitrary command execution as root, together with a persistent modification of the device hostname configuration. |
|---|
| स्रोत | ⚠️ https://gist.github.com/H3rmesk1t/06b1f0e03f9b97c6264d7a0f81956e3b |
|---|
| उपयोगकर्ता | LiuYijun (UID 101805) |
|---|
| सबमिशन | 30/09/2026 08:19 AM (18 दिन पहले) |
|---|
| संयम | 17/10/2026 11:56 PM (18 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 250459 [Totolink A3300R 17.0.0cu.557_B20221024 setWanCfg hostName अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|