| शीर्षक | Totolink X18 router V9.1.0cu.2053_B20230309 Command Injection |
|---|
| विवरण | A command injection vulnerability has been discovered in the TOTOLINK X18 Router. Attackers can exploit this vulnerability to execute arbitrary commands by sending malicious HTTP POST packets. The vulnerability is triggered when the request path is `/cgi-bin/cstecgi.cgi`, requiring login to obtain a `token`.
The trigger point is located in the `sub_41080C` method of the `cstecgi.cgi` component. Here, the `pid` field is not validated and is directly appended to `kill %s`, and then the `CsteSystem` method is used to execute the command. |
|---|
| स्रोत | ⚠️ https://github.com/jinhao118/cve/blob/main/TOTOLINK%20X18%20Router.md |
|---|
| उपयोगकर्ता | allanp0e (UID 94632) |
|---|
| सबमिशन | 09/02/2026 03:13 PM (8 महीनों पहले) |
|---|
| संयम | 20/02/2026 03:52 PM (11 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 226034 [TOTOLINK X18 9.1.0cu.2024_B20220329 disconnectVPN pid अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|