TOTOLINK CP900 Command Injection Vulnerability

A command injection vulnerability has been identified in the TOTOLINK CP900 outdoor CPE, specifically in version V6.3c.1144_B20190715. The issue arises in the 'CloudSrvUserdataVersionCheck' function, where the 'url' and 'magicid' parameters can be manipulated to execute arbitrary commands on the device via a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' on the device's IP address. Include the 'topicurl' parameter set to 'CloudSrvUserdataVersionCheck', and craft the 'url' and 'magicid' parameters to include command injection payloads, such as '1;pwd;' and '2;pwd;'.