CVE-2022-38826 In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.
The issue occurs when there is no /etc/passwd file, or the /etc/passwd file contains errors, this will lead to the execution of arbitrary commands.
How to fix the issue?
Upgrade to the latest TOTOLINK V4.1.5cu.709_B20210518 or later. Download the latest TOTOLINK V4.1.5cu.709_B20210518 and upgrade the server.
After upgrading the server, restart the server. After restarting the server, check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.
After restarting the server, check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.
TOTOLINK V4.1.5cu.709_B20210518 Upgrade Guide
TOTOLINK V4.1.5cu.709_B20210518:
Download the latest TOTOLINK V4.1.5cu.709_B20210518 and upgrade the server. After upgrading the server, restart the server. Check if there is any error in /etc/passwd file. If there is any error in /etc/passwd file, it will be corrected automatically. If there is no error in /etc/passwd file, you can manually enter the /etc/passwd file. After entering the /etc/passwd file, restart the server.>>END>>
Timeline
Published on: 09/16/2022 15:15:00 UTC
Last modified on: 09/17/2022 02:22:00 UTC