| Title | TOTOLINK NR1800X V9.1.0u.6681_B20230703 Command Injection |
|---|
| Description | OS Command Injection Vulnerability in TOTOLINK NR1800X
Vendor: TOTOLINK
Product: NR1800X
Firmware Version: V9.1.0u.6681_B20230703
Vulnerability Description
A command injection vulnerability exists in the setUploadSetting handler of the TOTOLINK NR1800X firmware (V9.1.0u.6681_B20230703).
During analysis, the firmware binary was examined without access to a physical device. Since the original authentication mechanism requires a valid session cookie before reaching the vulnerable code path, the binary was patched in the analysis environment to bypass the authentication check and simulate the required execution context. This modification was performed solely to facilitate vulnerability analysis and does not affect the root cause of the vulnerability.
Additionally, the setUploadSetting function has been stripped in the released firmware, requiring reverse engineering to recover its functionality.
The vulnerable code directly incorporates user-controlled input into a shell command and executes it via system() without sufficient input validation or sanitization. As a result, an attacker capable of reaching the vulnerable endpoint may be able to execute arbitrary operating system commands with the privileges of the web service process.
Root Cause
The vulnerability is caused by the use of system() with a command string constructed from user-supplied input without proper validation or escaping, resulting in an OS command injection vulnerability (CWE-78).
Security Impact
Successful exploitation may allow an authenticated attacker to execute arbitrary system commands on the affected device, potentially compromising the confidentiality, integrity, and availability of the system. |
|---|
| Source | ⚠️ https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/TOTOLink%20setUploadSetting%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%20.pdf |
|---|
| User | Anonymous User |
|---|
| Submission | 07/15/2026 10:26 (2 months ago) |
|---|
| Moderation | 08/29/2026 20:51 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 214283 [TOTOLINK NR1800X 9.1.0u.6279_B20210910 setUploadSetting FileName command injection] |
|---|
| Points | 0 |
|---|