TOTOLINK CA300-POE Command Injection Vulnerability

A command injection vulnerability has been identified in the TOTOLINK CA300-POE router, specifically in the firmware version V6.2c.884_B20180522. The vulnerability arises in the 'msg_process' function, where the 'Url' parameter can be manipulated to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'Action' parameter set to 'RemoteUpgradeFW', 'ProxyEnabled' set to '1', and the 'Url' parameter crafted to include the desired command, such as '1;pwd;'.