| शीर्षक | TOTOLINK X5000R V9.1.0cu.2089_B20211224 Command Injection |
|---|
| विवरण | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the `cstecgi.cgi` component, specifically in the `exportOvpn` handler when processing the `filetype=gz` branch.
The handler parses the HTTP query string using `getNthValueSafe()`. When `type=user` is specified, the third `&`-delimited field is copied into an intermediate buffer and then parsed using `=`. The value after `=` is stored in `v49` without validation or shell escaping.
When the supplied field begins with `filetype=gz`, the handler enters the gzip export branch and constructs the following command:
`openvpn-cert build_user %s gz`
where `%s` is replaced directly by the attacker-controlled value in `v49`. The resulting command is then executed through `system()`.
For example, a crafted value such as `filetype=gz;ls;` causes the extracted value `gz;ls;` to be incorporated into the shell command, allowing shell metacharacters to terminate the intended command and execute an arbitrary command.
This vulnerability is reachable through the `exportOvpn` handler and allows an attacker to execute arbitrary operating-system commands with the privileges of the vulnerable CGI process.
|
|---|
| स्रोत | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md |
|---|
| उपयोगकर्ता | awigwu76 (UID 91463) |
|---|
| सबमिशन | 17/08/2026 11:02 AM (30 दिन पहले) |
|---|
| संयम | 15/09/2026 11:03 AM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404082 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 Export Ovpn cstecgi.cgi?action=exportOvpn&type=user exportOvpn filetype अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|