ToToLink A3300R Command Injection Vulnerability

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. This vulnerability allows attackers to execute arbitrary commands by manipulating the 'user' parameter in a POST request to '/cgi-bin/cstecgi.cgi'. The issue arises because the 'user' parameter is not properly sanitized before being passed to a function that executes commands on the system.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'user' parameter set to a crafted value that includes the desired command. The request must be made with the appropriate headers to mimic a legitimate XMLHttpRequest. Once the request is sent, the injected command will be executed on the device.