| tiêu đề | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 Mini (tomato-K26-1.28.RT-MIPSR2-124-Mini.trx, release build5x-124-EN, 2014-12-24). Likely affects other OS Command Injection (CWE-78, post-authentication) |
|---|
| Mô tả | The router service binary /sbin/rc reads 25+ administrator-writable NVRAM keys in function new_qoslimit_start (offset 0x42419C, 2640 bytes). All values — including wan_iface (6 occurrences), qos_ibw, qos_obw, qosl_dlr/dlc/ulr/ulc, limit_br1~3_* (15 keys), and new_qoslimit_rules — are embedded via fprintf without any sanitization into a #!/bin/sh shell script /etc/qoslimit. The script is chmod 0700, then executed as root through eval() → fork+execvp at 0x424BB0 when QoS bandwidth limiting starts (WAN connect via start_wan_done, or service restart via exec_service).
An authenticated web administrator can inject shell metacharacters into any of these NVRAM keys. Impact is full root compromise (C/I/A). Attack surface is extremely wide (25+ injection points). NVRAM values persist across reboots, and the exploit re-triggers automatically on WAN establishment.
Dynamic verification: QEMU MIPS user-mode, original firmware rootfs, LD_PRELOAD NVRAM shim, bwrap sandbox, strace confirms write(692) → chmod(0700) → fork(), proof file /tmp/pwned_qoslimit_start created. |
|---|
| Nguồn | ⚠️ https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/02-new_qoslimit_start.md |
|---|
| Người dùng | WH-YHUST (UID 98329) |
|---|
| Đệ trình | 19/06/2026 11:56 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 06/08/2026 07:47 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386454 [Shibby Tomato 1.28.0000 /etc/qoslimit new_qoslimit_start new_qoslimit_enable nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|