CVEs-PoC/2021/CVE-2021-43711.md

CVE-2021-43711

Description

The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution.

POC

Reference

• https://github.com/doudoudedi/ToTolink_EX200_Cmmand_Execute/blob/main/ToTolink%20EX200%20Comand%20Injection2.md

Github

• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/attilaszia/linux-iot-cves
• https://github.com/doudoudedi/ToTolink_EX200_Cmmand_Execute