ToToLink A3300R Command Injection Vulnerability in STUN Server Address Parameter

A command injection vulnerability has been identified in ToToLink A3300R routers running firmware version 17.0.0cu.557_B20221024. The issue arises in the CGI script 'cstecgi.cgi', where attackers can execute arbitrary commands by manipulating the 'stunServerAddr' parameter. The vulnerability is exploited by sending crafted HTTP POST requests that include the malicious command in the STUN server address field.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'stunServerAddr' parameter set to a crafted value that includes a command, such as a wget command to download a file from a remote server. The request should be made with the appropriate headers to mimic a legitimate XMLHttpRequest.