| Title | TOTOLINK X5000R V9.1.0cu.2089_B20211224 Command Injection |
|---|
| Description | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the `cstecgi.cgi` component, specifically in the `exportOvpn` handler when processing the `filetype=gz` branch.
The handler parses the HTTP query string using `getNthValueSafe()`. When `type=user` is specified, the third `&`-delimited field is copied into an intermediate buffer and then parsed using `=`. The value after `=` is stored in `v49` without validation or shell escaping.
When the supplied field begins with `filetype=gz`, the handler enters the gzip export branch and constructs the following command:
`openvpn-cert build_user %s gz`
where `%s` is replaced directly by the attacker-controlled value in `v49`. The resulting command is then executed through `system()`.
For example, a crafted value such as `filetype=gz;ls;` causes the extracted value `gz;ls;` to be incorporated into the shell command, allowing shell metacharacters to terminate the intended command and execute an arbitrary command.
This vulnerability is reachable through the `exportOvpn` handler and allows an attacker to execute arbitrary operating-system commands with the privileges of the vulnerable CGI process.
|
|---|
| Source | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md |
|---|
| User | awigwu76 (UID 91463) |
|---|
| Submission | 08/17/2026 11:02 (29 days ago) |
|---|
| Moderation | 09/15/2026 11:03 (29 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 404082 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 Export Ovpn cstecgi.cgi?action=exportOvpn&type=user exportOvpn filetype os command injection] |
|---|
| Points | 20 |
|---|