Submit #1022555: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection

The cste framework separates configuration from enforcement: the web handlers store their parameters in the MIB with apmib_set(), and the standalone bin/sysconf program later reads those values back and turns them into shell commands. sysconf is a 202 KB root binary that contains more than twenty command templates in which a configuration value is interpolated with %s, including route add -net default gw %s dev eth1 > /dev/null 2>&1, brctl delif br0 %s 2>/dev/null, echo %s > /var/cpurate, echo %s > /var/log/log_split, reload -k %s &, flash get %s, /tmp/%s, udhcpc -i %s -p %s -s %s &, udhcpd %s and chaddr %s. The templates are fed from the MIB, and the MIB is written by the web handlers, so the two stages are decoupled: a handler that stores an unfiltered string does not execute anything itself, and the value is interpreted by sysconf at a later point, in a different process, with no knowledge of its origin. This is what makes the defect a stored injection rather than a simple one. The two ends of the chain are both real: on the writing side, several handlers store strings without applying Validity_check — firewall.so setMacFilterRules and the other rule handlers store their rule text directly, and lan.so setStaticDhcpConfig stores a comment into the reserved-IP record — and on the consuming side, sysconf builds command lines from those records and executes them as root. A value that contains a line feed, a space or a shell metacharacter therefore changes the meaning of the command that sysconf generates, even when the same value was harmless in the handler that stored it. The entry is rated High because the two stages are both under the attacker's control: identifying a specific MIB identifier and the template that consumes it is a reconnaissance step, not a precondition outside the attacker's reach, and the payload is then executed as root by sysconf. The record width constrains the length of the value that survives the round trip through the flash layout, which is why the attack complexity is scored as high, but it does not reduce the impact. It is reported because the pattern is architectural and affects every rule handler in the firmware, and because the two ends have been confirmed statically: the templates from the strings of bin/sysconf, and the unfiltered MIB writes from the decompilation of the module handlers.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/1046036a8601e93f375754e11307bfc8
• User: LiuYijun_JX.SGCC (UID 102035)
• Submission: 10/10/2026 04:01 (21 days ago)
• Moderation: 10/26/2026 14:13 (16 days later)
• Status: Accepted
• VulDB entry: 426404 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 firewall.so apmib_set command injection]
• Points: 20