TOTOLink CA750-PoE OS Command Injection Vulnerability

A command injection vulnerability has been identified in the TOTOLink CA750-PoE router running firmware version 6.2c.510. The issue arises in the Setting Handler component, specifically within the 'setUploadUserData' function of the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'FileName' argument in a crafted request.

Impact

Exploitation of this vulnerability leads to unauthorized execution of operating system commands on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'FileName' parameter set to a command payload, such as 'telnetd -l /bin/sh -p 8894'. The router will execute the injected command, providing a shell access through the specified port.