| 标题 | TOTOLINK X6000R 9.4.0cu.652_B20230116 CWE-78 OS Command Injection |
|---|
| 描述 | The UploadFirmwareFile handler of the shttpd web service on TOTOLINK X6000R
9.4.0cu.652_B20230116 retrieves the JSON parameter "file_name" from unauthenticated
POST requests to /cgi-bin/cstecgi.cgi and passes it unvalidated to firmware_check().
When firmware_check() fails (achievable at will with a crafted file_name), the handler
enters an error path that formats the same attacker-controlled string into
snprintf(buf, 0x80, "rm -f %s", file_name) // shttpd VA 0x415308
and executes the buffer through CsteSystem() at VA 0x41546c (wrapper of system()).
A single request therefore executes arbitrary shell commands as the web-service
process. No authentication is required and the request-handler-level command
blacklist filter (shttpd function at 0x416ea0) is not applied to this handler.
Distinction from CVE-2025-52053 (same product, parameter "file_name",
firmware 9.4.0cu.1360_B20241207): that entry locates the injection inside
firmware_check() of libcscommon.so (sub_417D74 -> do_system). This report covers
a different vulnerable function in a different binary — the shttpd-local
"rm -f" cleanup path (sub_415258, firmware 9.4.0cu.652_B20230116) — which remains
independently exploitable. |
|---|
| 用户 | liumingjie (UID 101308) |
|---|
| 提交 | 2026-09-16 16時40分 (20 日前) |
|---|
| 管理 | 2026-10-05 17時02分 (19 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 413619 [TOTOLINK X6000R 9.4.0cu.652_B20230116 UploadFirmwareFile /cgi-bin/cstecgi.cgi firmware_check file_name 权限提升] |
|---|
| 积分 | 17 |
|---|