| Título | TOTOLINK X5000R V9.1.0cu.2089_B20211224 Command Injection |
|---|
| Descrição | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the `cstecgi.cgi` component, specifically in the `exportOvpn` handler when processing the `filetype=gz` branch.
The handler parses the HTTP query string using `getNthValueSafe()`. When `type=user` is specified, the third `&`-delimited field is copied into an intermediate buffer and then parsed using `=`. The value after `=` is stored in `v49` without validation or shell escaping.
When the supplied field begins with `filetype=gz`, the handler enters the gzip export branch and constructs the following command:
`openvpn-cert build_user %s gz`
where `%s` is replaced directly by the attacker-controlled value in `v49`. The resulting command is then executed through `system()`.
For example, a crafted value such as `filetype=gz;ls;` causes the extracted value `gz;ls;` to be incorporated into the shell command, allowing shell metacharacters to terminate the intended command and execute an arbitrary command.
This vulnerability is reachable through the `exportOvpn` handler and allows an attacker to execute arbitrary operating-system commands with the privileges of the vulnerable CGI process.
|
|---|
| Fonte | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md |
|---|
| Utilizador | awigwu76 (UID 91463) |
|---|
| Submissão | 17/08/2026 11h02 (há 30 dias) |
|---|
| Moderação | 15/09/2026 11h03 (29 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 404082 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 Export Ovpn cstecgi.cgi?action=exportOvpn&type=user exportOvpn filetype Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|