TOTOLINK T6 Command Injection Vulnerability in Traceroute Configuration

A critical command injection vulnerability has been identified in the TOTOLINK T6 router, specifically in version 4.1.5cu.748_B20211015. The issue arises in the HTTP POST request handler, within the function 'setTracerouteCfg' of the file '/cgi-bin/cstecgi.cgi'. This vulnerability allows remote attackers to inject commands by manipulating the 'command' argument, potentially leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for command injection, with the potential for remote code execution on the affected device.

Reproduction

To reproduce this vulnerability, send a malicious HTTP POST request to the TOTOLINK T6 router's '/cgi-bin/cstecgi.cgi' endpoint. Include the 'command' argument in the request, manipulating it to inject arbitrary commands. The router will execute the injected commands, demonstrating the command injection vulnerability.