Submit #1003217: TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection

The diagnostic handler setDiagnosisCfg implements the ping test offered by the administration interface. It reads two fields from the JSON request body, ip and num, converts the second to an integer, and composes a shell command by placing the first field into a printf-style format string without any sanitisation. The composed string is ping <ip> -w <num> &>/var/log/pingCheck, and it is passed to the vendor wrapper CsteSystem, which forks and executes /bin/sh with the string as its -c argument. Because the client-supplied value is neither quoted nor filtered for shell metacharacters, an attacker can terminate the ping command with a semicolon and append arbitrary commands. The web server runs as root under the procd supervisor defined in /etc/init.d/shttpd, so the appended commands execute with full administrative privilege. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. The injected id returned uid=0(root). A practical payload must include a packet count such as -c 1, because ping without a count does not terminate and the shell would never proceed to the appended commands; the payload used in the proof of concept takes this into account. The result is arbitrary command execution as root from an authenticated position on the management network.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/e05081360e8b65d6447851ffc8139cc7
• User: H3rmesk1t (UID 70306)
• Submission: 09/27/2026 16:32 (18 days ago)
• Moderation: 10/14/2026 14:50 (17 days later)
• Status: Duplicate
• VulDB entry: 233325 [Totolink A3300R 17.0.0cu.557_B20221024 setDiagnosisCfg ip command injection]
• Points: 0