TOTOLINK X5000R OS Command Injection Vulnerability in VPN Account Configuration

An OS command injection vulnerability has been identified in the TOTOLINK X5000R router, specifically in firmware version 9.1.0cu.2350_b20230313. The vulnerability arises in the 'setVpnAccountCfg' function within the '/web/cgi-bin/cstecgi.cgi' file. Authenticated attackers can exploit this issue by sending crafted requests that include malicious commands in the 'user', 'pass', 'limit', and 'desc' parameters. These commands are then executed on the operating system, potentially leading to unauthorized command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'user', 'pass', 'limit', and 'desc' parameters. Include the malicious payloads in these parameters, formatted as commands to be executed. The request should be made with an authenticated session.