TOTOLINK T10 Buffer Overflow Vulnerability in UploadCustomModule Function

A critical buffer overflow vulnerability has been identified in the TOTOLINK T10 router, specifically in the firmware version 4.1.8cu.5207. The issue arises in the UploadCustomModule function within the POST request handler, located in the file /cgi-bin/cstecgi.cgi. The vulnerability is triggered by manipulating the File parameter in a POST request, leading to a buffer overflow condition. This vulnerability can be exploited remotely, and details of the exploit have been disclosed publicly.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.