Submit #1007226: TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection

The wireless access-control handler setWiFiAclRules reads the mac and desc fields from the JSON request body, joins them into a single string with a comma, and passes the result to the library function wificonf_add_by_key together with the interface index and the option name maclist. The composition of the shell command does not happen in the web server: it happens inside wificonf_add_by_key, which is defined in the shared object usr/lib/libcscommon.so. That function builds the option path wireless.<ifname>.maclist and then formats the string uci add_list <path>="<value>", placing the caller-supplied value inside double quotes without escaping it, and executes the result through CsteSystem, which runs /bin/sh -c as root. A double quote inside the value therefore closes the quoted region and the remainder is parsed by the shell as command syntax. The value that reaches the library is the concatenation of the mac and desc fields, so either field can carry the payload. This finding is architecturally distinct from the other command injections in this firmware: the injection point is not in the web binary at all, and a review that enumerates dangerous calls only within shttpd will not observe it, because shttpd merely calls a library function whose name does not suggest command execution. The paired function wificonf_del_by_key, reached from the delWiFiAclRules handler, exhibits the same defect and can be driven from a value that the first function has stored. The handler is registered in the dispatch table as requiring authentication, and the proof of concept below therefore establishes an authenticated session through loginAuth and supplies the resulting identifier as the token query parameter before the injection is attempted. The result is arbitrary command execution as root.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/6e600b514fc58c312f60ab6081f58eb5
• User: LiuYijun (UID 101805)
• Submission: 09/30/2026 08:22 (18 days ago)
• Moderation: 10/17/2026 23:59 (18 days later)
• Status: Duplicate
• VulDB entry: 252405 [Totolink A3300R 17.0.0cu.557_B20221024 setWiFiAclRules desc command injection]
• Points: 0