TOTOLink CA750-PoE OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in the TOTOLink CA750-PoE router running firmware version 6.2c.510. The issue arises in the Setting Handler component, specifically within the 'setWebWlanIdx' function of the '/cgi-bin/cstecgi.cgi' file. The vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the 'webWlanIdx' argument in a crafted request. Exploitation of this vulnerability is possible with publicly available exploits.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'webWlanIdx' parameter set to a crafted command, such as 'telnetd -l /bin/sh -p 8888'. The router will execute the command, providing a shell access through the specified port.