| タイトル | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection |
|---|
| 説明 | The UploadFirmwareFile handler of the shttpd web service on TOTOLINK X6000R
9.4.0cu.652_B20230116 retrieves the JSON parameter "file_name" from unauthenticated
POST requests to /cgi-bin/cstecgi.cgi and passes it unvalidated to firmware_check().
When firmware_check() fails (achievable at will with a crafted file_name), the handler
enters an error path that formats the same attacker-controlled string into
snprintf(buf, 0x80, "rm -f %s", file_name) // shttpd VA 0x415308
and executes the buffer through CsteSystem() at VA 0x41546c (wrapper of system()).
A single request therefore executes arbitrary shell commands as the web-service
process. No authentication is required and the request-handler-level command
blacklist filter (shttpd function at 0x416ea0) is not applied to this handler.
Distinction from CVE-2025-52053 (same product, parameter "file_name",
firmware 9.4.0cu.1360_B20241207): that entry locates the injection inside
firmware_check() of libcscommon.so (sub_417D74 -> do_system). This report covers
a different vulnerable function in a different binary — the shttpd-local
"rm -f" cleanup path (sub_415258, firmware 9.4.0cu.652_B20230116) — which remains
independently exploitable. |
|---|
| ユーザー | liumingjie (UID 101308) |
|---|
| 送信 | 2026年09月16日 16:40 (19 日 ago) |
|---|
| モデレーション | 2026年10月05日 17:02 (19 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413619 [TOTOLINK X6000R 9.4.0cu.652_B20230116 UploadFirmwareFile /cgi-bin/cstecgi.cgi firmware_check file_name 特権昇格] |
|---|
| ポイント | 17 |
|---|