TOTOLINK X5000R OS Command Injection Vulnerability in setScheduleCfg

A command injection vulnerability has been identified in the TOTOLINK X5000R router, specifically in firmware version 9.1.0cu.2350_b20230313. The issue arises in the 'setScheduleCfg' function within the '/web/cgi-bin/cstecgi.cgi' file, where the 'minute' parameter is not properly validated. This flaw allows authenticated attackers to send crafted requests that execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'minute' parameter containing a crafted command, such as one that lists directory contents and redirects the output to a file in the '/tmp' directory. Include the 'token' parameter with a valid session token to authenticate the request.