| 标题 | TOTOLINK X5000R V9.1.0cu.2089_B20211224 Command Injection |
|---|
| 描述 | TOTOLINK X5000R firmware v9.1.0cu.2089_B20211224 contains an OS command injection vulnerability in the `cstecgi.cgi` component, specifically in the `exportOvpn` handler when processing the `filetype=gz` branch.
The handler parses the HTTP query string using `getNthValueSafe()`. When `type=user` is specified, the third `&`-delimited field is copied into an intermediate buffer and then parsed using `=`. The value after `=` is stored in `v49` without validation or shell escaping.
When the supplied field begins with `filetype=gz`, the handler enters the gzip export branch and constructs the following command:
`openvpn-cert build_user %s gz`
where `%s` is replaced directly by the attacker-controlled value in `v49`. The resulting command is then executed through `system()`.
For example, a crafted value such as `filetype=gz;ls;` causes the extracted value `gz;ls;` to be incorporated into the shell command, allowing shell metacharacters to terminate the intended command and execute an arbitrary command.
This vulnerability is reachable through the `exportOvpn` handler and allows an attacker to execute arbitrary operating-system commands with the privileges of the vulnerable CGI process.
|
|---|
| 来源 | ⚠️ https://github.com/awigwu76/TOTOLINK_X5000R/blob/main/2.md |
|---|
| 用户 | awigwu76 (UID 91463) |
|---|
| 提交 | 2026-08-17 11時02分 (30 日前) |
|---|
| 管理 | 2026-09-15 11時03分 (29 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 404082 [TOTOLINK X5000R 9.1.0cu.2089_B20211224 Export Ovpn cstecgi.cgi?action=exportOvpn&type=user exportOvpn filetype 权限提升] |
|---|
| 积分 | 20 |
|---|