ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. This vulnerability allows attackers to execute arbitrary commands by exploiting the pppoeServiceName parameter in the cgi-bin/cstecgi.cgi script. The issue arises because the vulnerable function retrieves the parameter value from the request and passes it to a system command execution function without proper sanitization.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the pppoeServiceName parameter set to a command payload, such as a wget command. The crafted request should include the necessary headers and payload to mimic a legitimate XMLHttpRequest.