TOTOLINK X5000R OS Command Injection Vulnerability in WiFi Schedule Configuration

An OS command injection vulnerability has been identified in the TOTOLINK X5000R router, specifically in firmware version 9.1.0cu.2350_B20230313. The vulnerability arises in the 'setWiFiScheduleCfg' function within the '/web/cgi-bin/cstecgi.cgi' file. Authenticated attackers can exploit this issue by sending crafted requests that include malicious commands in the 'desc' parameter, which are then executed on the operating system.

Impact

Exploitation of this vulnerability allows authenticated attackers to execute arbitrary commands on the router's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'desc' parameter containing a command injection payload, such as a command followed by output redirection to a file. Include additional parameters required by the 'setWiFiScheduleCfg' function, such as 'week', 'sHour', 'sMinute', 'eHour', and 'eMinute'.