TOTOLink CA750-PoE Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the TOTOLink CA750-PoE router, specifically in the firmware version 6.2c.510. The issue arises in the Setting Handler component, within the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the FileName argument in a crafted request.

Impact

Exploitation of this vulnerability leads to unauthorized execution of operating system commands on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /cgi-bin/cstecgi.cgi endpoint. Include a payload in the FileName parameter that contains the desired command, such as 'telnetd -l /bin/sh -p 8893'. The router will execute the command, providing a shell access through the specified port.