TOTOLINK T6 Command Injection Vulnerability in HTTP POST Request Handler

A critical command injection vulnerability has been identified in the TOTOLINK T6 router, specifically in the version 4.1.5cu.748. The issue arises in the HTTP POST request handler, within the 'delDevice' function of the '/cgi-bin/cstecgi.cgi' file. The vulnerability allows remote attackers to inject commands by manipulating the 'ipAddr' argument. This flaw has been publicly disclosed and is exploitable.

Impact

Exploitation of this vulnerability allows for command injection, with the potential for remote code execution.

Reproduction

To reproduce this vulnerability, send a malicious HTTP POST request to the '/cgi-bin/cstecgi.cgi' endpoint, targeting the 'delDevice' function. Manipulate the 'ipAddr' argument to inject commands. The vulnerability can be exploited remotely, without authentication.