ToToLink A3300R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in ToToLink A3300R firmware version 17.0.0cu.557_B20221024. The issue arises in the cgi-bin/cstecgi.cgi script, where attackers can execute arbitrary commands by manipulating the interval parameter. The vulnerability is exploited by sending a crafted POST request that includes a command in the interval field, which is then executed on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the interval parameter set to a command, such as one that downloads a file from a remote server. The command will be executed on the device, demonstrating the command injection vulnerability.