St4R0002

A security flaw allows remote OS command injection via the `asp setPing` endpoint. The issue exists in the `system()` function within the `www/ping.asp` file, where manipulating the `pingstr` variable enables the execution of arbitrary operating system commands.

An OS command injection flaw exists in the `asp WlanMP` endpoint within the `www/wlanMP.asp` file. This issue occurs when the `ateFunc` argument is manipulated, allowing a remote attacker to execute arbitrary operating system commands via the `system()` function.

A remote command injection issue exists in the `/cgi-bin/cstecgi.cgi` endpoint. The flaw occurs within the `getCurrentTime()` function when the `ntp server` variable is manipulated, allowing an attacker to execute arbitrary commands on the system.

A stack-based buffer overflow exists in the NTP Timezone Configuration Handler within the `uci safe get()` function of the `/cgi-bin/apply time.cgi` endpoint. This issue occurs because the function lacks adequate bounds checking when processing inputs, allowing a remote, unauthenticated attacker to overwrite stack data and execute arbitrary code. The flaw can be triggered by manipulating the `system.ntp.server`, `system.ntp.enable server`, `cameo.time.time zone`, or `cameo.cameo.syslog server` variables.

A weakness in the CLI Configuration Tool allows for remote command injection. This issue occurs within the `nvram get()` function, where improper manipulation can lead to the execution of arbitrary commands on the system.

A remote command injection issue exists within the ssi component. By manipulating the `filename` argument in the '/cgi-bin/upload.cgi' endpoint, an attacker can execute arbitrary commands on the system.

A stack-based buffer overflow exists in the CGI Handler component. The issue occurs within the `setSystemConfig()` function located in the '/cgi-bin/cstecgi.cgi' endpoint. A remote attacker can trigger this by manipulating the `Hostname` argument. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution.