| Título | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection |
|---|
| Descrição | A vulnerability was found in Totolink A3300R 17.0.0cu.557_b20221024 . Affected by this vulnerability is the function sub_41F5D0 of the component cstecgi.cgi . The manipulation of the argument lanIp with an unknown input leads to a command injection vulnerability.We found a Command Injection vulnerability in shttpd , allows remote attackers to execute arbitrary OS commands from a crafted request.In sub_41F5D0 function, it reads in a user-provided parameter lanIp and passes its value to Uci_Set_Str function.However ,the value of the lanIp is inserted into v11 using snprintf,and the value of v11 will be handled by the function CsteSystem.Finally,the command will be executed by execv() in CsteSystem. |
|---|
| Fonte | ⚠️ https://github.com/Litengzheng/vul_db/blob/main/A3300R/vul_39/README.md |
|---|
| Utilizador | LtzHuster2 (UID 96397) |
|---|
| Submissão | 13/03/2026 02h38 (há 17 dias) |
|---|
| Moderação | 29/03/2026 19h51 (17 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 354126 [Totolink A3300R 17.0.0cu.557_b20221024 Parameter /cgi-bin/cstecgi.cgi setLanCfg lanIp Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|