| Título | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Descrição | setDiagnosisCfg is the diagnostic ping tool. It is implemented in lib/cste_modules/system.so and dispatched by bin/cste_sub from the topic totolink/router/system/setDiagnosisCfg. The handler reads the target with websGetVar(a2, "ipDoamin", "www.baidu.com") and passes it to Validity_check before interpolating it into sprintf(s, "ping %s -w 4 &>/var/log/pingCheck", Var) and calling CsteSystem(s, 0). This is one of the four handlers in the firmware that do apply the framework's filter, so the naive payloads are rejected: the semicolon, the pipe, the ampersand, the backtick, the dollar sign, the greater-than sign, the slash and the literal strings .sh, iptables and telnetd are all blocked. The filter is however an incomplete blacklist, and the character it omits is the one that matters most here: the line feed. The value is interpolated into the command line without any quoting, so a line feed in ipDoamin terminates the ping command and starts a new one, and the remainder of the format string — the -w 4 &>/var/log/pingCheck suffix — can be neutralised with a hash so that the shell ignores it. A payload such as x.x.x.x<LF>id<LF># therefore produces three lines: ping x.x.x.x, id, and a comment. The command runs as root. Because the slash is blocked, payloads that name a path cannot be used directly; the practical forms are short commands whose output is not returned (id, ls, ps) or a reverse shell that does not contain a slash, such as nc -l -p 2323 -e sh. |
|---|
| Fonte | ⚠️ https://gist.github.com/H3rmesk1t/a615ea3dc4b28e0078acf0bc7623619b |
|---|
| Utilizador | H3rmesk1t (UID 70306) |
|---|
| Submissão | 09/10/2026 08h22 (há 14 dias) |
|---|
| Moderação | 21/10/2026 20h17 (12 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 195146 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R setDiagnosisCfg ipDoamin Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|