CVE-2023-.md

TOTOlink A7100RU(V7.4cu.2313_B20191024) has command injection vulnerability

Basic Information

vendor website address：http://totolink.net/

firmware download address：http://totolink.net/home/menu/detail/menu_listtpl/download/id/185/ids/36.html

1. Effect Version

V7.4cu.2313_B20191024

2. Details

In set branch has a function related to setWizardCfg

In this function, User can imput data in json type which key name is pptpIp and value is what we want. This value will transform to staticip which is used in a function called Uci-Set-Str

This function has a command injection vulnerability because "" can be escaped by $()

3. Achive Effect

TOTOlink A7100RU(V7.4cu.2313_B20191024)路由器存在命令注入漏洞

基本信息

厂商信息：http://totolink.net/

固件下载地址：http://totolink.net/home/menu/detail/menu_listtpl/download/id/185/ids/36.html

1. 影响版本

V7.4cu.2313_B20191024

2. 漏洞细节

在set分支里面存在setWizardCfg的函数

在这个函数里面用户通过输入pptpIp传入staticip值 而staticIp会进入Uci-Set-Str函数

这个函数存在着命令执行的漏洞，通过$()绕过双引号实现命令执行

3. 漏洞实现效果