Totolink A3300R Command Injection Vulnerability

A command injection vulnerability has been identified in the Totolink A3300R router, specifically in version 17.0.0cu.557_b20221024. The issue arises in the Parameter Handler component, within the function setLanCfg of the file /cgi-bin/cstecgi.cgi. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the lanIp parameter in a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the lanIp parameter set to a command that you wish to execute. The router will execute the command and return the result. This can be done using a tool like curl or Postman, or through a simple Python script.