Provide an before and after config file.. So we can test on other routers models about cve-2022-30075

[aaronsvk]

Provided example of manual exploitation uses parameter system.button.handler which requires mentioned step. Other parameters (e.g. ddns.service.ip_script used by python exploit) dont require this step

[aaronsvk]

For other tp-link router please take a look at section "manual exploitation"

[minanagehsalalma]

@aaronsvk i had just checked it's great

after reboot, push the led button that triggers execution of injected command /usr/sbin/telnetd -l /bin/login.sh

but is that step required ?

[minanagehsalalma]

Provided example of manual exploitation uses parameter system.button.handler which requires mentioned step. Other parameters (e.g. ddns.service.ip_script used by python exploit) dont require this step

@aaronsvk thanks a lot

Pls add that info to the guide

As you know it's not actual RCE if it requires local access to the target.

Can we have a list of parameters that require pressing a button and the others that don't? As this really needed for the guide.

Thanks

[minanagehsalalma]

Also on what basis did you choose these exact parameters? Also is the vuln related to the parsing of the config file or other processes like the httpd reading info from it with no sterilization(filters)?

[splashsc]

另外，您选择这些确切参数的依据是什么？漏洞是否与配置文件的解析或其他进程有关，例如 httpd 从它读取信息而没有灭菌（过滤器）？

Excuse me, have you verified it successfully

[minanagehsalalma]

@aaronsvk i wasn't able to find any of these handlers in my config backup file

can't i just put the command in place of a value of any xml tag ?

also can i added the handlers from your example to my config even that i wasn't able to find them in mine ?

Thanks