TOTOLINK X5000R OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the TOTOLINK X5000R router running firmware version 9.1.0cu.2089_B20211224. The issue arises in the CGI binary 'cstecgi.cgi', specifically within the 'exportOvpn' handler. The vulnerability is triggered when the 'user' parameter is passed to the 'snprintf' function and subsequently executed by the 'system' command without proper input validation or sanitization. This flaw allows remote attackers to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a request to '/cgi-bin/cstecgi.cgi' with the 'action' parameter set to 'exportOvpn', the 'type' parameter set to 'user', and the 'user' parameter containing the injected command. The injected command will be executed on the device, demonstrating the command injection vulnerability.