Submit #1022552: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection

setNoticeCfg configures the captive-portal notice that the device shows to clients. It is implemented in lib/cste_modules/system.so and dispatched by bin/cste_sub from the topic totolink/router/system/setNoticeCfg. The handler reads NoticeUrl, BtnName, three whitelist URLs, IpFrom, IpTo and NoticeTimeoutVal, and it validates the URL fields with Validity_check and a length limit of 128 bytes. The two IP fields receive a different treatment: they are only checked with strlen(nptr_1) < 4 and strlen(nptr_2) < 4, so each may contain up to three characters of arbitrary content, and they are then used to build a range string by copying the LAN prefix, appending IpFrom, appending a hyphen and appending IpTo to a copy of the LAN address. That range string is the second conversion of sprintf(command, "notice %s 3 %s %d", dest_1, s, v38), which is executed with system(command). The string is not quoted, so a semicolon inside it is a command separator: with IpFrom set to a single digit and IpTo set to ;id, the range string becomes 192.168.01-192.168.0.1;id and the resulting command line is notice <url> 3 192.168.01-192.168.0.1;id 120, in which the notice program runs first and id then executes as root with the timeout value as its argument. The three-byte limit is a genuine constraint and it is why this entry is rated Medium rather than High: the injected command cannot name a path, because a slash would exceed the limit, and it cannot carry arguments of its own, because the remainder of the line is consumed by the numeric timeout argument. The practical effect is therefore limited command execution with no output channel — enough to run id, ls, ps, date, mount or nc without arguments, and enough to be chained with a second handler that can stage a larger payload, but not by itself a convenient interactive shell. The defect is nevertheless a genuine command-injection primitive in a handler that runs as root, and it is reported because the same pattern — an IP field that is length-limited but not character-limited, interpolated into an unquoted command — should be removed.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/408968930540a72db87ec833f1be560f
• User: LiuYijun_JX.SGCC (UID 102035)
• Submission: 10/10/2026 03:59 (21 days ago)
• Moderation: 10/26/2026 14:07 (16 days later)
• Status: Duplicate
• VulDB entry: 308112 [TOTOLINK A950RG 4.1.2cu.5204_B20210112 system.so setNoticeCfg IpTo command injection]
• Points: 0