TOTOLINK CA600-PoE Command Injection Vulnerability in NTPSyncWithHost Function

A command injection vulnerability has been identified in the TOTOLINK CA600-PoE router, specifically in the firmware version V5.3c.6665_B20180820. The vulnerability arises in the NTPSyncWithHost function, where the hostTime parameter can be manipulated to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the device's CGI interface (cstecgi.cgi) with the hostTime parameter crafted to include a command, such as '1`pwd`'. This request can be made using a web browser or a tool like curl, ensuring to include the necessary headers and cookies for authentication.