Submit #1022556: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Information Disclosure

The administrative interface of the TOTOLINK A950RG is built on the vendor's cste framework: lighttpd serves the static front end from /web_cste and forwards every business request to web_cste/cgi-bin/cstecgi.cgi, which validates the caller and then relays the request over an internal MQTT broker to bin/cste_sub, the process that loads and invokes the per-feature shared objects under lib/cste_modules. The whole scheme is protected by a single session token: loginAuth writes a 32-character hexadecimal value into /tmp/cookie_key, and every subsequent request is accepted only when the token field of its JSON body is byte-identical to that file. cstecgi.cgi maintains a short whitelist of topicurl values that bypass that check entirely, and setting/getLanguageCfg is one of them. The whitelist exists so that the login page can render the product banner and the language list before a session exists, but the handler it admits does far more than that. getLanguageCfg in global.so assembles a JSON object that describes the device — firmware version, product name, LAN address, wireless BSSID, language list and help URLs — and, at the end of that object, it checks whether /tmp/cookie_key exists and, if it does, executes getCmdResult("cat /tmp/cookie_key", s, 128) and attaches the result to the response under the key token. The active administrative session token is therefore disclosed, in plain text, to any client that can reach TCP port 80, with no credential, cookie or prior interaction of any kind. Because the token is exactly the value the gate compares against, the attacker can then replay it in the token field of any other request and be treated as the logged-in administrator for the remaining lifetime of the session, which is 300 seconds but is refreshed on every accepted request, so a single captured token can be kept alive indefinitely by continuing to poll. The same handler also creates the /var/kkkkkk authentication backdoor when the stored login password is empty, an independent defect that is reported separately as A950RG-AUTH-04 in the audit report. The practical consequence of this finding is that every post-authentication defect in the firmware — command injection, buffer overflow and configuration export alike — is downgraded to a pre-authentication issue for as long as an administrator is logged in, and that an attacker on the network can escalate to a fully authenticated management session without ever knowing a password.

• User: LiuYijun_JX.SGCC (UID 102035)
• Submission: 10/10/2026 04:02 (21 days ago)
• Moderation: 10/26/2026 14:14 (16 days later)
• Status: Accepted
• VulDB entry: 426405 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 global.so getLanguageCfg token information disclosure]
• Points: 20