漏洞描述
TOTOLINK A3300R是一款广泛使用的无线路由器，提供高性能的网络连接服务。该漏洞存在于TOTOLINK A3300R路由器的setDdnsCfg功能中，由于username参数未正确过滤用户输入，攻击者可以通过注入恶意命令并执行任意系统命令，导致远程代码执行，危害系统安全。
TOTOLINK A3300R SetDdnsCfg /cgi-bin/cstecgi.cgi 命令执行漏洞 （CVE-2024-23059）
PoC代码
暂无相关漏洞推荐
- POC CVE-2019-19824: TOTOLINK Realtek SD Routers - Remote Command Injection
- POC CVE-2021-42887: TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass
- POC CVE-2022-25082: TOTOLink - Unauthenticated Command Injection
- POC CVE-2023-30013: TOTOLink - Unauthenticated Command Injection
- POC CVE-2023-46574: TOTOLINK A3700R - Command Injection
- POC CVE-2024-24328: TotoLink Router setMacFilterRules - Command Injection
- POC CVE-2024-24329: TotoLink Router setPortForwardRules - Command Injection
- POC CVE-2024-34257: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection
- POC CVE-2024-51228: TOTOLINK CX-A3002RU - Remote Code Execution
- POC CVE-2024-7332: TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability
- POC CVE-2022-25084: TOTOLink T6 V5.9c.4085_B20190428 Command Injection
- POC CVE-2023-46574: TOTOLINK A3700R存在RCE漏洞
- POC CVE-2024-51228: TOTOLINK CX-A3002RU RCE