TOTOLINK A6000R Command Injection Vulnerability in Password Change Function

A command injection vulnerability has been identified in the TOTOLINK A6000R router, specifically in version 1.0.1-B20201211.2000. The issue arises in the action_passwd function, where the newpasswd parameter is improperly sanitized, allowing attackers to inject and execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device with the same privileges as the application or service processing the request.