TOTOLINK X15 Command Injection Vulnerability in formMapReboot Function

A critical command injection vulnerability has been identified in the TOTOLINK X15 router, specifically in version 1.0.0-B20230714.1105. The issue arises in the formMapReboot function within the file /boafrm/formMapReboot. The vulnerability is triggered by manipulating the deviceMacAddr argument, which lacks proper input validation, allowing for arbitrary command execution. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /boafrm/formMapReboot endpoint. The request must include a deviceMacAddr parameter with a crafted value that exploits the lack of input validation. This can be done using a standard web browser or a tool that allows for HTTP request manipulation, such as Burp Suite or Postman.