TOTOLINK X18 Command Injection Vulnerability in setEasyMeshAgentCfg Function

A command injection vulnerability has been identified in the TOTOLINK X18 router, specifically in version V9.1.0cu.2053_B20230309. The vulnerability arises in the setEasyMeshAgentCfg function, where the mac parameter can be manipulated to execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a POST request to the device's CGI endpoint with a payload that includes a crafted mac parameter. The payload can be designed to execute commands on the device, such as reading the passwd file and writing it to a web-accessible location.