| 제목 | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection |
|---|
| 설명 | The UploadFirmwareFile handler of the shttpd web service on TOTOLINK X6000R
9.4.0cu.652_B20230116 retrieves the JSON parameter "file_name" from unauthenticated
POST requests to /cgi-bin/cstecgi.cgi and passes it unvalidated to firmware_check().
When firmware_check() fails (achievable at will with a crafted file_name), the handler
enters an error path that formats the same attacker-controlled string into
snprintf(buf, 0x80, "rm -f %s", file_name) // shttpd VA 0x415308
and executes the buffer through CsteSystem() at VA 0x41546c (wrapper of system()).
A single request therefore executes arbitrary shell commands as the web-service
process. No authentication is required and the request-handler-level command
blacklist filter (shttpd function at 0x416ea0) is not applied to this handler.
Distinction from CVE-2025-52053 (same product, parameter "file_name",
firmware 9.4.0cu.1360_B20241207): that entry locates the injection inside
firmware_check() of libcscommon.so (sub_417D74 -> do_system). This report covers
a different vulnerable function in a different binary — the shttpd-local
"rm -f" cleanup path (sub_415258, firmware 9.4.0cu.652_B20230116) — which remains
independently exploitable. |
|---|
| 사용자 | liumingjie (UID 101308) |
|---|
| 제출 | 2026. 09. 16. PM 04:40 (20 날 ago) |
|---|
| 모더레이션 | 2026. 10. 05. PM 05:02 (19 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413619 [TOTOLINK X6000R 9.4.0cu.652_B20230116 UploadFirmwareFile /cgi-bin/cstecgi.cgi firmware_check file_name 권한 상승] |
|---|
| 포인트들 | 17 |
|---|