TOTOLINK CA300-PoE CloudSrvUserdataVersionCheck Function Command Injection Vulnerability

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884B20180522, which stems from the CloudSrvUserdataVersionCheck function url parameter failing to correctly filter constructed command...