| Título | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Descrição | NTPSyncWithHost sets the system clock from a time value supplied by the host. It is implemented in lib/cste_modules/system.so and dispatched by bin/cste_sub from the topic totolink/router/system/NTPSyncWithHost. The handler reads the time string with websGetVar(a2, "hostTime", ""), passes it to Validity_check and then interpolates it into sprintf(s_1, "date -s \"%s\"", Var) before calling CsteSystem(s_1, 0). This handler does apply the framework's blacklist, so the naive payloads are rejected, but the conversion is placed inside double quotes and the filter does not reject the double quote itself. A double quote in hostTime therefore closes the quoted argument, and the remainder of the value is parsed as shell syntax: the payload \";id;# produces the command line date -s "";id;#", in which date -s "" fails harmlessly, id executes as root, and the trailing #" is a comment. The line feed is also absent from the blacklist, but it is not the character to use here: inside double quotes a line feed is a literal character rather than a command separator, so a payload based on it would not execute. The double quote is the correct and sufficient escape. Because the slash is on the blacklist, payloads that name a path cannot be used directly; the practical forms are short commands whose output is not returned (id, ps, date) or a reverse shell without a slash, such as nc -l -p 2323 -e sh. The same parameter also overflows the 256-byte command buffer, which is a separate defect. |
|---|
| Fonte | ⚠️ https://gist.github.com/H3rmesk1t/26b5476044c35705faa3d5c54f3e2ae5 |
|---|
| Utilizador | H3rmesk1t (UID 70306) |
|---|
| Submissão | 09/10/2026 08h23 (há 14 dias) |
|---|
| Moderação | 21/10/2026 20h17 (12 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 195153 [TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R NTPSyncWithHost host_time Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|