| Titolo | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 Mini (tomato-K26-1.28.RT-MIPSR2-124-Mini.trx, release build5x-124-EN, 2014-12-24). Likely affects other OS Command Injection (post-authentication) |
|---|
| Descrizione | The router service binary /sbin/rc reads administrator-writable NVRAM key wan_iface in function new_qoslimit_stop (offset 0x423F74, 248 bytes). The value is embedded via fprintf without sanitization into a #!/bin/sh shell script /tmp/qoslimittc_stop.sh, then chmod 0700, then executed as root through eval() → fork+execvp at 0x424048 when QoS bandwidth limiting is stopped (WAN disconnect or service restart via exec_service).
An authenticated web administrator can set wan_iface to contain shell metacharacters (e.g. eth0;touch /tmp/pwned;#). Impact is full root compromise (C/I/A). NVRAM values persist across reboots.
Dynamic verification: QEMU MIPS user-mode, original firmware rootfs (a26ef07dc0fdf82967c20555e238ad3ead1d0cf3), LD_PRELOAD NVRAM shim, bwrap sandbox, strace confirms open("/tmp/qoslimittc_stop.sh") → write(97) → chmod(0700) → fork(), and proof file /tmp/pwned_qoslimit_stop created. |
|---|
| Fonte | ⚠️ https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/01-new_qoslimit_stop.md |
|---|
| Utente | WH-YHUST (UID 98329) |
|---|
| Sottomissione | 19/06/2026 11:41 (2 mesi fa) |
|---|
| Moderazione | 06/08/2026 07:47 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 386453 [Shibby Tomato 1.28.0000 /tmp/qoslimittc_stop.sh new_qoslimit_stop wan_iface escalationi di privilegi] |
|---|
| Punti | 20 |
|---|