Submit #1007223: TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection

The WAN configuration handler setWanCfg selects a configuration branch from the proto field of the JSON request body. In the branch that configures the DHCP client it reads the hostName field and, after storing it into the device configuration, composes the shell string echo '<hostName>' > /proc/sys/kernel/hostname. The value is wrapped in single quotes in the format string but is not escaped, so a single quote inside the value terminates the quoted region and allows an arbitrary command to be inserted. The composed string is executed through doSystem, which formats the result into a 512-byte buffer with vsnprintf and passes it to system, and the web server runs as root. Because the value is stored into the main.hostname and wan.hostname configuration options before the command is composed, an attacker also leaves persistent configuration behind. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. The branch is selected by any proto value other than the explicit cases zero, three and four; the values one, two, five and nine were each confirmed to reach the vulnerable code. The result is arbitrary command execution as root, together with a persistent modification of the device hostname configuration.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/06b1f0e03f9b97c6264d7a0f81956e3b
• User: LiuYijun (UID 101805)
• Submission: 09/30/2026 08:19 (18 days ago)
• Moderation: 10/17/2026 23:56 (18 days later)
• Status: Duplicate
• VulDB entry: 250459 [Totolink A3300R 17.0.0cu.557_B20221024 setWanCfg hostName command injection]
• Points: 0