| 제목 | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection |
|---|
| 설명 | A vulnerability was found in Totolink A3300R 17.0.0cu.557_b20221024 . Affected by this vulnerability is the function sub_41F5D0 of the component cstecgi.cgi . The manipulation of the argument lanIp with an unknown input leads to a command injection vulnerability.We found a Command Injection vulnerability in shttpd , allows remote attackers to execute arbitrary OS commands from a crafted request.In sub_41F5D0 function, it reads in a user-provided parameter lanIp and passes its value to Uci_Set_Str function.However ,the value of the lanIp is inserted into v11 using snprintf,and the value of v11 will be handled by the function CsteSystem.Finally,the command will be executed by execv() in CsteSystem. |
|---|
| 원천 | ⚠️ https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_39/README.md |
|---|
| 사용자 | LtzHuster2 (UID 96397) |
|---|
| 제출 | 2026. 03. 13. AM 02:38 (17 날 ago) |
|---|
| 모더레이션 | 2026. 03. 29. PM 07:51 (17 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 354126 [Totolink A3300R 17.0.0cu.557_b20221024 Parameter /cgi-bin/cstecgi.cgi setLanCfg lanIp 권한 상승] |
|---|
| 포인트들 | 20 |
|---|