Invia #977219: TOTOLINK A3002MU V1.0.0-B20230403.1455 OS Command Injection

The WPS PIN branch of the /boafrm/formWsc handler of the TOTOLINK A3002MU reaches a shell command through a state round trip rather than directly, which defeats parameter-level filtering at the HTTP layer and makes the flaw invisible to request inspection. When the handler is invoked with a non-empty triggerPIN field it reads the localPin parameter, compares it against the current value of MIB entry 273 and, if the values differ, stores the attacker-supplied string into MIB 273 with apmib_set(). Later in the same invocation, provided MIB entry 270 indicates that WPS is enabled, the handler reads MIB 273 back into a stack buffer with apmib_get() and formats that value into the command template echo %s > /var/wps_local_pin, which is passed to system() and executed as root. The value that is ultimately executed is therefore not the request parameter but the MIB field, so any sanitisation applied to the parameter on its way in is irrelevant unless it is also applied when the value is written into the MIB. No such sanitisation exists: MIB 273 is a string entry and is written verbatim. The prerequisites are all reachable without credentials: MIB 270 can be set to a non-zero value with a single disableWPS=ON request issued to the same handler, and the comparison against the current PIN succeeds for any attacker-chosen value on a device whose PIN has not been set to that value. Two constraints bound the payload: the value must differ from the current MIB 273 contents, and the length is limited by the size of the MIB string field, which is nevertheless large enough for a command chain of the form ;cmd>/var/web/out;. The impact is the same as for the direct injection: arbitrary command execution as root on an unauthenticated network-reachable interface, with the device's own document root available as an exfiltration channel.

• Fonte: ⚠️ https://gist.github.com/H3rmesk1t/4fcce0ea9728b1804e84551cadf5c1af
• Utente: H3rmesk1t (UID 70306)
• Sottomissione: 14/09/2026 10:57 (21 giorni fa)
• Moderazione: 05/10/2026 00:18 (21 days later)
• Stato: Duplicato
• Voce VulDB: 407552 [Totolink A3002MU Hh-B20211125.1046 /boafrm/formWsc localPin escalationi di privilegi]
• Punti: 0