TOTOLINK Wireless Routers Remote Command Execution

Multiple TOTOLINK network products contain a command injection vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the command parameter. After exploitation, an attacker will have full access with the same user privileges under which the webserver is running - which is typically root.

access attacker command command injection exploitation injection network parameter privileges products root routers running under vulnerability webserver wireless