| タイトル | TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection |
|---|
| 説明 | The WAN configuration handler setWanCfg selects a configuration branch from the proto field of the JSON request body. In the branch that configures the DHCP client it reads the hostName field and, after storing it into the device configuration, composes the shell string echo '<hostName>' > /proc/sys/kernel/hostname. The value is wrapped in single quotes in the format string but is not escaped, so a single quote inside the value terminates the quoted region and allows an arbitrary command to be inserted. The composed string is executed through doSystem, which formats the result into a 512-byte buffer with vsnprintf and passes it to system, and the web server runs as root. Because the value is stored into the main.hostname and wan.hostname configuration options before the command is composed, an attacker also leaves persistent configuration behind. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. The branch is selected by any proto value other than the explicit cases zero, three and four; the values one, two, five and nine were each confirmed to reach the vulnerable code. The result is arbitrary command execution as root, together with a persistent modification of the device hostname configuration. |
|---|
| ソース | ⚠️ https://gist.github.com/H3rmesk1t/06b1f0e03f9b97c6264d7a0f81956e3b |
|---|
| ユーザー | LiuYijun (UID 101805) |
|---|
| 送信 | 2026年09月30日 08:19 (19 日 ago) |
|---|
| モデレーション | 2026年10月17日 23:56 (18 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 250459 [Totolink A3300R 17.0.0cu.557_B20221024 setWanCfg hostName 特権昇格] |
|---|
| ポイント | 0 |
|---|