| Titolo | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection |
|---|
| Descrizione | The UploadFirmwareFile handler of the shttpd web service on TOTOLINK X6000R
9.4.0cu.652_B20230116 retrieves the JSON parameter "file_name" from unauthenticated
POST requests to /cgi-bin/cstecgi.cgi and passes it unvalidated to firmware_check().
When firmware_check() fails (achievable at will with a crafted file_name), the handler
enters an error path that formats the same attacker-controlled string into
snprintf(buf, 0x80, "rm -f %s", file_name) // shttpd VA 0x415308
and executes the buffer through CsteSystem() at VA 0x41546c (wrapper of system()).
A single request therefore executes arbitrary shell commands as the web-service
process. No authentication is required and the request-handler-level command
blacklist filter (shttpd function at 0x416ea0) is not applied to this handler.
Distinction from CVE-2025-52053 (same product, parameter "file_name",
firmware 9.4.0cu.1360_B20241207): that entry locates the injection inside
firmware_check() of libcscommon.so (sub_417D74 -> do_system). This report covers
a different vulnerable function in a different binary — the shttpd-local
"rm -f" cleanup path (sub_415258, firmware 9.4.0cu.652_B20230116) — which remains
independently exploitable. |
|---|
| Utente | liumingjie (UID 101308) |
|---|
| Sottomissione | 16/09/2026 16:40 (20 giorni fa) |
|---|
| Moderazione | 05/10/2026 17:02 (19 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 413619 [TOTOLINK X6000R 9.4.0cu.652_B20230116 UploadFirmwareFile /cgi-bin/cstecgi.cgi firmware_check file_name escalationi di privilegi] |
|---|
| Punti | 17 |
|---|