TOTOLINK N150RT Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the TOTOLINK N150RT router, specifically in the firmware version 3.4.0-B20190525. This vulnerability allows remote attackers to execute arbitrary commands on the device by manipulating the 'localPin' parameter in a POST request to '/boafrm/formWsc'.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/boafrm/formWsc' with a crafted 'localPin' parameter. This can be done using a tool like Burp Suite. Once the request is sent, the injected command will be executed on the router's operating system.