CVE-2022-38826 In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.

The issue occurs when there is no /etc/passwd file, or the /etc/passwd file contains errors, this will lead to the execution of arbitrary commands.

How to fix the issue?

Upgrade to the latest TOTOLINK V4.1.5cu.709_B20210518 or later. Download the latest TOTOLINK V4.1.5cu.709_B20210518 and upgrade the server.

After upgrading the server, restart the server. After restarting the server, check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.






After restarting the server, check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.

TOTOLINK V4.1.5cu.709_B20210518:
Download the latest TOTOLINK V4.1.5cu.709_B20210518 and upgrade the server. After upgrading the server, restart the server. Check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.>>END>>

Timeline

Published on: 09/16/2022 15:15:00 UTC
Last modified on: 09/17/2022 02:22:00 UTC

References