| Title | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Description | The cloud-upgrade path of the A950RG contains two command-injection sinks in lib/cste_modules/upgrade.so. The first is in setCloudUpgradeFW, which receives a file path, copies it into a 256-byte stack buffer with strcpy and then builds sprintf(s_2, "rm -rf %s 1>/dev/null 2>&1", s) and calls CsteSystem(s_2, 0). That function is not itself a registered handler, but it is reached from the registered handler CloudACMunualUpdate, which forwards the attacker-controlled FileName parameter through update_fw_by_ini; the call runs in a forked child, so the injection is executed asynchronously and is not visible in the response. The sink is reached on the error path, which is taken whenever the named file does not exist or is smaller than 1000 bytes — that is, for any FileName that the attacker invents, so the request needs no valid firmware image. The second sink is in dl, which reads the download URL from /tmp/DlFileUrl with getStrFromTmp, builds sprintf(s, "wget -O %s %s", a1, s_1) and calls CsteSystem(s, 0). That file is written by bin/cloudupdate_check, which executes echo %s > /tmp/DlFileUrl with the URL taken from the cloud server response, so this sink is a second-order injection whose input is the cloud server's answer rather than a web parameter: a malicious, compromised or man-in-the-middle cloud endpoint can place shell metacharacters into the URL and have them executed by wget on the device, as root. Because neither sink is guarded by Validity_check, the full shell metacharacter set is available in both. The first sink is the practical one for a web attacker, because it needs only the token; the second matters as an attack on the update supply chain. Note that the routes setting/setCloudUpgradeFW and setting/dl do not exist — upgrade.so registers only setUpgradeFW, setUploadSetting and CloudACMunualUpdate — so any test plan that targets those two names directly will not reach either sink. |
|---|
| Source | ⚠️ https://gist.github.com/H3rmesk1t/c2f2dcfdb6238a7ddb8fb0622ad52948 |
|---|
| User | LiuYijun_JX.SGCC (UID 102035) |
|---|
| Submission | 10/10/2026 03:59 (22 days ago) |
|---|
| Moderation | 10/26/2026 14:13 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426402 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 Cloud Upgrade upgrade.so setCloudUpgradeFW FileName command injection] |
|---|
| Points | 20 |
|---|