提交 #876022: Totolink EX1200L Firmware V9.3.5u.6146_B20201023 NULL Pointer Dereference

A vulnerability has been identified in TOTOLINK EX1200L firmware V9.3.5u.6146_B20201023 in the CGI program cstecgi.cgi, specifically in the handler associated with the JSON topic setPasswordCfg. The issue is caused by insufficient validation of required password-related input fields before the data is used in string-processing logic.

When cstecgi.cgi receives a JSON request whose topicurl is set to "setPasswordCfg" but which omits the additional password parameters expected by the handler, the request is still accepted and execution continues into the password-processing code path. During this path, at least one string value that should have been validated is left as NULL and is later passed into libc's strcoll() function. Since strcoll() expects valid pointers to NUL-terminated strings, dereferencing a NULL argument causes the process to terminate with SIGSEGV.

The vulnerability was reproduced against the official TOTOLINK EX1200L firmware image V9.3.5u.6146_B20201023 under qemu-mipsel-based firmware emulation. Debugging confirms that the crash occurs inside libc.so.0 at strcoll(). At the time of the fault, the first argument register points to a valid memory location while the second argument register is NULL. The faulting instruction attempts to load a byte from the NULL pointer, which directly explains the segmentation fault.

As a result, an attacker able to reach the affected CGI endpoint can crash the CGI process and cause denial of service of the web management functionality. The core issue is improper input validation leading to a NULL pointer dereference in the password configuration handler.

• 来源: ⚠️ https://gist.github.com/wyxstarry/afdc067090575c216a9d2622c3338e5c
• 用户: yuxin_wang (UID 98928)
• 提交: 2026-07-01 10時02分 (2 月前)
• 管理: 2026-08-17 15時11分 (2 months later)
• 状态: 已接受
• VulDB条目: 391272 [TOTOLINK EX1200L 9.3.5u.6146_B20201023 Password Configuration /cgi-bin/cstecgi.cgi setPasswordCfg 拒绝服务]
• 积分: 20