ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue arises in the cgi-bin/cstecgi.cgi script, where the stun-pass parameter can be manipulated to execute arbitrary commands. This vulnerability allows attackers to send crafted requests that are processed by the device, leading to unauthorized command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the stun-pass parameter set to a crafted value that includes the desired command. The request must be formatted as application/x-www-form-urlencoded and include the necessary headers to mimic a legitimate XMLHttpRequest. Once the request is sent, the injected command will be executed on the device.