TOTOLink CA750-PoE Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the TOTOLink CA750-PoE router running firmware version 6.2c.510. The issue arises in the Setting Handler component, specifically within the 'setWiFiWpsConfig' function of the '/cgi-bin/cstecgi.cgi' file. By manipulating the 'PIN' argument, remote attackers can inject and execute arbitrary operating system commands. The vulnerability has been publicly disclosed and is exploitable via a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, potentially leading to a full compromise of the router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'PIN' parameter set to a crafted command, such as 'telnetd -l /bin/sh -p 8896'. This will execute the command on the router, providing a shell access through the specified telnet port.