| शीर्षक | Totolink X2000R V1-B20250707 OS Command Injection |
|---|
| विवरण | TOTOLINK X2000R V1-B20250707 contains an OS command injection vulnerability in the formWsc function of the boa web server, reachable via POST /boafrm/formWsc. The targetAPSsid parameter is processed by an escaping routine that neutralizes the double quote ("), backtick (`) and backslash (\) characters but does not neutralize the $(...) command-substitution sequence. The value is then embedded, inside double quotes, into the command iwpriv wlan0 set_mib wsc_specssid="<targetAPSsid>", which is executed via system() (/bin/sh -c). Because $(...) is not escaped and remains active inside double quotes, a remote attacker can supply a crafted targetAPSsid value to execute arbitrary operating-system commands as root, resulting in full device compromise. |
|---|
| उपयोगकर्ता | dsec (UID 100004) |
|---|
| सबमिशन | 22/07/2026 08:14 AM (2 महीनों पहले) |
|---|
| संयम | 06/09/2026 10:47 AM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 310918 [TOTOLINK X2000R 1.0.0-B20230726.1108 /boafrm/formWsc peerRptPin अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|