TOTOLINK CA600-PoE Command Injection Vulnerability in Firmware Upgrade Function

A command injection vulnerability has been identified in the TOTOLINK CA600-PoE router, specifically in the firmware version V5.3c.6665_B20180820. The issue arises in the 'recvUpgradeNewFw' function, where the 'fwUrl' parameter can be manipulated to execute arbitrary commands on the device. This vulnerability can be exploited by sending a crafted request that includes malicious command payloads.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' on the router's IP address. Include the 'fwUrl' parameter in the request body, appending a command payload such as '1;pwd;'. This will execute the injected command, in this case, 'pwd', which returns the current directory.