Threats tagged 'ghsa-q788-r29g-853f'

A command injection vulnerability exists in the ToToLink A720R Router firmware version 4.1.5cu.614_B20230630. The flaw is located in the sysconf binary's sub_40BFA4 function, which handles network interface reinitialization. Input from the '/var/system/linux_vlan_reinit' file is only partially validated by checking interface name prefixes and is directly concatenated into shell commands executed via system() without proper escaping. An attacker with write access to this file can execute arbitrary commands on the device.