TOTOLINK A3002R Command Injection Vulnerability in bupload.html Component

A command injection vulnerability has been identified in the TOTOLINK A3002R router, specifically in version 4.0.0-B20230531.1404. The issue arises in the bupload.html component, which is used for uploading binary files during firmware updates. This vulnerability allows attackers to execute arbitrary commands by manipulating the request's field values.

Impact

Exploitation of this vulnerability allows for OS command injection, where injected commands are executed on the device's operating system.

Reproduction

To reproduce this vulnerability, upload a file through the web interface that accepts firmware images. After selecting the file, use Burp Suite to intercept and modify the request. Inject a command into the 'filename' parameter, separating commands with semicolons. Once the modified request is sent, the injected command will be executed on the device.