| Title | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Description | The device-information handler of the LAN module builds a shell command out of a value that it has previously persisted, and neither step validates the value. getDeviceInfo @ 0x27E0 reads /var/lib/misc/udhcpd.leases through getOneDhcpClient, and for every lease whose MAC address is not all zeros it executes sprintf(command, "echo '%s' > /var/MacPort_state;csteSys sendMac %s", v24, v24) followed by system(command), where v24 is the MAC address. The same value is passed to isLanClient @ 0x26B0, which executes sprintf(s, "cat /var/MacPort_state | grep %s | cut -f2 -d=", s1) through getCmdStr. Both templates are structurally injectable: the first places the value inside single quotes that it does not escape and then appends a second, unquoted use of the same value after a semicolon; the second interpolates it unquoted into a pipeline. The reason this entry is rated Medium rather than High is the provenance of the value: the MAC address is taken from the DHCP lease database, and a DHCP client cannot place a single quote or a semicolon into the hardware-address field, because the field is a six-byte Ethernet address that udhcpd records in the aa:bb:cc:dd:ee:ff form. The defect is therefore latent rather than directly reachable: it becomes a root command-execution primitive as soon as any other route can write a crafted line into the lease database or into /var/MacPort_state, and it should be fixed as if it were reachable, because the two functions sit on a data path whose input is a file that several components write. It is reported here so that the pattern — a persisted value that is re-interpolated into a shell command with no validation at either step — is recorded and removed. |
|---|
| Source | ⚠️ https://gist.github.com/H3rmesk1t/836a8c4be24fcc4b7041b4bbe9cbb178 |
|---|
| User | LiuYijun_JX.SGCC (UID 102035) |
|---|
| Submission | 10/10/2026 04:00 (21 days ago) |
|---|
| Moderation | 10/26/2026 14:13 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426403 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 device-information udhcpd.leases getDeviceInfo MAC address command injection] |
|---|
| Points | 20 |
|---|