TOTOLINK CA600-PoE recvUpgradeNewFw Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the recvUpgradeNewFw function failing to properly filter construct command special characters, commands, etc. No detailed...