| tiêu đề | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Command Injection |
|---|
| Mô tả | setDeviceName stores the user-visible device name together with the MAC address it is associated with. It is implemented in lib/cste_modules/global.so and dispatched by bin/cste_sub from the topic totolink/router/global/setDeviceName. The handler reads deviceMac and deviceName with websGetVar, both without any length or character validation, and interpolates them into a shell command with sprintf(s, "echo '%s,%s' > /mnt/customDeviceName", Var, v7) followed by system(s). The two conversions are wrapped in single quotes, but the quotes are not escaped and no escaping is applied to the values, so a single quote inside deviceName closes the quoted string and turns the remainder into shell syntax: the value x'; id; ' produces the command line echo 'x',x'; id; '' > /mnt/customDeviceName, in which id is executed as root. The handler contains a second and more interesting path: when /mnt/customDeviceName already exists it is read back line by line, and each line is written again with sprintf(s, "echo '%s' >> /mnt/customDeviceName", s_2) followed by system(s). Any single quote or metacharacter that was stored by a previous request is therefore re-interpreted by a later request, which makes the defect a second-order injection: a value that is harmless when written becomes executable when the handler is invoked a second time, and an administrator who only inspects the stored configuration file will not see a command. Because Validity_check is not called by this handler, the full shell metacharacter set is available. |
|---|
| Nguồn | ⚠️ https://gist.github.com/H3rmesk1t/b41e4da73ef921d725e00a2088463531 |
|---|
| Người dùng | H3rmesk1t (UID 70306) |
|---|
| Đệ trình | 09/10/2026 08:21 (cách đây 13 ngày) |
|---|
| Kiểm duyệt | 21/10/2026 20:16 (12 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 307315 [TOTOLINK A950RG 4.1.2cu.5204_B20210112 global.so setDeviceName deviceMac nâng cao đặc quyền] |
|---|
| điểm | 0 |
|---|