TOTOLINK CA600-PoE Command Injection Vulnerability in Firmware Upgrade Function

A command injection vulnerability has been identified in the TOTOLINK CA600-PoE router, specifically in the firmware version V5.3c.6665_B20180820. The issue arises in the 'setUpgradeFW' function, where the 'FileName' parameter can be manipulated to execute arbitrary commands on the device via a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi?action=upload&setting/setUpgradeFW' on the device's IP address. The request must include a 'Content-Disposition' header that specifies a 'filename' parameter. The 'filename' value should be crafted to include command injection payloads. Ensure that the 'SESSION_ID' cookie is included to maintain an active session.