ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue allows attackers to execute arbitrary commands by exploiting the ttlWay parameter in the cgi-bin/cstecgi.cgi script. The vulnerability arises because the ttlWay parameter is not properly sanitized before being passed to a system command execution function.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the ttlWay parameter set to a crafted command, such as a wget command that retrieves a file from a remote server. The request must include the appropriate headers to mimic a legitimate XMLHttpRequest.