Submit #1007227: TOTOLINK A3300R V17.0.0cu.592_B20231030 Command Injection

The handler NTPSyncWithHost sets the device clock from a time value supplied by the client. It reads the host_time field of the JSON request body, passes it through the filter sub_415954, and when the filter reports no match it stops the NTP daemon, composes the shell string date -s '<host_time>' and executes it through CsteSystem as root. The filter is a blacklist that rejects the semicolon, the ampersand, the pipe character, the backtick, the dollar sign and the newline, together with the substrings .sh, iptables and telnetd. It does not reject the single quote, even though the format string wraps the value in single quotes, and it does not reject the redirection operators. A value that contains a single quote therefore closes the quoted region and the remainder of the string is interpreted by the shell as further syntax, which was confirmed by injecting a redirection that caused the shell to create a file as root. The impact is bounded by the fact that the blacklist does cover every character that separates commands and every documented form of command substitution: without a separator, an ampersand or a pipeline, the attacker cannot start a second command, and without the dollar sign or the backtick the attacker cannot embed one. What remains demonstrable is argument injection into the date utility, including the ability to supply further options, and arbitrary redirection of the command's standard output with root privilege, which permits truncating or overwriting any writable file with the output of date or with an empty string when the date argument is invalid. The severity is reported as medium for that reason, and the finding is retained because it demonstrates that the only input filter in the firmware is bypassable and because the same filter is reused by the NTP configuration handler, where a future format-string change would render it directly exploitable.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/ec13b7d2036a531171c27f2d7ecb29ca
• User: LiuYijun (UID 101805)
• Submission: 09/30/2026 08:23 (18 days ago)
• Moderation: 10/17/2026 23:59 (18 days later)
• Status: Duplicate
• VulDB entry: 336506 [TOTOLINK A3300R 17.0.0cu.596_B20250515 NTPSyncWithHost host_time command injection]
• Points: 0