TOTOLINK CP900 Command Injection Vulnerability in setUploadUserData Function

A command injection vulnerability has been identified in the TOTOLINK CP900 outdoor CPE, specifically in version V6.3c.1144_B20190715. The issue arises in the setUploadUserData function, where the FileName parameter can be manipulated to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the device's CGI interface (typically /cgi-bin/cstecgi.cgi) with the FileName parameter crafted to include a command injection payload. The injected command will be executed on the device, demonstrating the command injection vulnerability.