| शीर्षक | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection |
|---|
| विवरण | The UploadFirmwareFile handler of the shttpd web service on TOTOLINK X6000R
9.4.0cu.652_B20230116 retrieves the JSON parameter "file_name" from unauthenticated
POST requests to /cgi-bin/cstecgi.cgi and passes it unvalidated to firmware_check().
When firmware_check() fails (achievable at will with a crafted file_name), the handler
enters an error path that formats the same attacker-controlled string into
snprintf(buf, 0x80, "rm -f %s", file_name) // shttpd VA 0x415308
and executes the buffer through CsteSystem() at VA 0x41546c (wrapper of system()).
A single request therefore executes arbitrary shell commands as the web-service
process. No authentication is required and the request-handler-level command
blacklist filter (shttpd function at 0x416ea0) is not applied to this handler.
Distinction from CVE-2025-52053 (same product, parameter "file_name",
firmware 9.4.0cu.1360_B20241207): that entry locates the injection inside
firmware_check() of libcscommon.so (sub_417D74 -> do_system). This report covers
a different vulnerable function in a different binary — the shttpd-local
"rm -f" cleanup path (sub_415258, firmware 9.4.0cu.652_B20230116) — which remains
independently exploitable. |
|---|
| उपयोगकर्ता | liumingjie (UID 101308) |
|---|
| सबमिशन | 16/09/2026 04:40 PM (19 दिन पहले) |
|---|
| संयम | 05/10/2026 05:02 PM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413619 [TOTOLINK X6000R 9.4.0cu.652_B20230116 UploadFirmwareFile /cgi-bin/cstecgi.cgi firmware_check file_name अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|