Totolink A3300R Command Injection Vulnerability in setSmartQosCfg Function

A command injection vulnerability has been identified in the Totolink A3300R router, specifically in version 17.0.0cu.557_b20221024. The issue arises in the 'setSmartQosCfg' function within the '/cgi-bin/cstecgi.cgi' file, where the 'qos_up_bw' parameter can be manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the router's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'qos_up_bw' parameter set to a command payload, such as a 'wget' command that retrieves a file from a remote server. The router will execute the command, demonstrating the command injection vulnerability.