TOTOLINK CA600-PoE Command Injection Vulnerability in setWebWlanIdx Function

A command injection vulnerability has been identified in the TOTOLINK CA600-PoE router, specifically in the firmware version V5.3c.6665_B20180820. The issue arises in the setWebWlanIdx function, where the webWlanIdx parameter can be manipulated to execute arbitrary commands on the device via a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the device's CGI interface (e.g., /cgi-bin/cstecgi.cgi) with the 'webWlanIdx' parameter set to include the desired command. The request should be formatted as 'application/x-www-form-urlencoded' and can be sent using a tool like curl or Postman. Include the 'SESSION_ID' cookie to maintain an active session.