TOTOLINK CA300-PoE OS Command Injection Vulnerability

A critical OS command injection vulnerability has been identified in the TOTOLINK CA300-PoE router running firmware version 6.2c.884. The issue arises in the 'setUpgradeFW' function of the 'upgrade.so' file, where the 'FileName' argument can be manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a crafted request to the router's 'setUpgradeFW' function, manipulating the 'FileName' argument to inject OS commands. The command injection can be verified by executing a command that returns a response, such as 'id' or 'whoami'.