Executive brief
A security vulnerability exists in the ToToLink A720R router, a device used to provide wireless internet connectivity. An unauthenticated attacker can remotely send specially crafted requests to the router's update mechanism to take control of the device. This could allow an attacker to intercept network traffic, disrupt internet service, or use the router as a foothold to attack other devices on the local network.
Technical details
A command injection vulnerability exists in the 'cloudupdate_check' binary of the ToToLink A720R router, specifically within the sub_402414 function. The application uses 'websGetVar' to retrieve the 'magicid' and 'url' parameters from a POST request to '/cgi-bin/cloud_update.cgi'. These user-supplied values are directly concatenated into a command string via 'snprintf' and subsequently executed using the 'system()' function without any sanitization or escaping of shell metacharacters. An unauthenticated remote attacker can exploit this by injecting shell commands (e.g., using semicolons) into these parameters to achieve arbitrary code execution with the privileges of the web service. A Proof of Concept (PoC) demonstrating the injection via the 'magicid' and 'url' fields has been publicly disclosed.
Affected products
- ToToLink A720R Router V4.1.5cu.614_B20230630
Timeline
- 2025-11-13: advisory: Initial NVD publication date
- 2025-11-13: disclosed: Public disclosure of PoC on GitHub