TOTOLINK X2000R Command Injection Vulnerability Allowing Remote Code Execution

A critical command injection vulnerability has been identified in the TOTOLINK X2000R router, specifically in the firmware version 1.0.0-B20230726.1108. The vulnerability arises in the file '/boafrm/formMapDel', where the 'devicemac1' parameter can be manipulated to execute arbitrary commands on the device. This issue can be exploited remotely, and details of the exploit have been made public.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/boafrm/formMapDel' endpoint with a crafted 'devicemac1' parameter. The injected command will be executed on the device's operating system.