| शीर्षक | TOTOLINK X5000R v9.1.0cu.2089_B20211224 RCE |
|---|
| विवरण | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the cstecgi.cgi component, in the exportOvpn handler.
The parameter "user" is passed into snprintf() and invoked by system() without sanitization, allowing remote attackers to execute arbitrary commands on the device.
In function main(), the value of parameter "user" is taken from the query string via getNthValueSafe(), then formatted into:
snprintf(v55, 256, "openvpn-cert build_user %s config", v49);
followed by:
system(v55);
Because v49 is not validated nor escaped, an attacker can inject shell meta-characters.
|
|---|
| स्रोत | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/1.md |
|---|
| उपयोगकर्ता | awigwu76 (UID 91463) |
|---|
| सबमिशन | 03/12/2025 07:32 AM (10 महीनों पहले) |
|---|
| संयम | 12/12/2025 03:55 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 336206 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 cstecgi.cgi?action=exportOvpn&type=user snprintf अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|