| शीर्षक | Tomato by Shibby Tomato Firmware Tomato v1.28.0000 -120 K26ARM USB AIO-64K OS Command Injection |
|---|
| विवरण | The start_jffs2 function (sub_2D568) in sbin/rc retrieves the NVRAM key jffs2_exec and passes its value directly to the system() C library function. No sanitization, character filtering, escaping, or quoting is applied. An attacker who can write to NVRAM (e.g., via authenticated Web UI access or another vulnerability) can inject arbitrary shell commands that execute as root during the JFFS2 startup sequence.
v10 = nvram_get("jffs2_exec"); // 0x2D738
v11 = v10;
if (v10 && *v10) {
chdir("/jffs");
system(v11); // 0x2D75C — direct execution
chdir("/");
}
The system() function invokes /bin/sh -c <command>, so all shell metacharacters (;, &&, ||, `, $(), pipes) are interpreted. |
|---|
| स्रोत | ⚠️ https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5O |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 10/06/2026 03:57 PM (1 महीना पहले) |
|---|
| संयम | 12/07/2026 11:01 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 377896 [Shibby Tomato तक 1.28.0000 start_jffs2 sub_2D568 jffs2_exec अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|