TOTOLINK T6 Command Injection Vulnerability in HTTP POST Request Handler

A critical command injection vulnerability has been identified in the TOTOLINK T6 router, specifically in the version 4.1.5cu.748_B20211015. The issue arises in the HTTP POST request handler, within the function 'setDiagnosisCfg' of the file '/cgi-bin/cstecgi.cgi'. The vulnerability allows remote attackers to inject commands by manipulating the 'ip' argument, potentially leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the affected device.

Reproduction

To reproduce this vulnerability, send a malicious HTTP POST request to the TOTOLINK T6 router's '/cgi-bin/cstecgi.cgi' endpoint. Include the 'ip' argument with a payload that exploits the command injection flaw. This can be done remotely, taking advantage of the router's exposed web interface.