TOTOLINK A6000R Command Injection Vulnerability in the Reboot Action

A command injection vulnerability has been identified in the TOTOLINK A6000R router, specifically in firmware version V1.0.1-B20201211.2000. The vulnerability arises in the 'action_reboot' function within the '/usr/lib/lua/luci/controller/admin/system.lua' file. It allows for arbitrary command execution by injecting commands through the 'opmode' parameter when the reboot action is called.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a GET request to the '/cgi-bin/luci/admin/system/reboot' endpoint with the 'opmode' parameter. Inject a command, such as 'ls>333.txt', into the 'opmode' parameter. After the request is processed, the injected command will be executed, and its output can be verified by checking the result of the injection.