Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection

Vulnerability

The Totolink A8000RU router version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the /cgi-bin/cstecgi.cgi file, specifically within the setUpgradeFW function. The function reads the user-supplied resetFlags parameter and passes it unsanitized to snprintf, which builds a command string that is later executed via CsteSystem and execv(). An attacker can inject arbitrary OS commands into the resetFlags parameter. The vulnerability is present in the web management interface and can be triggered remotely without authentication, as demonstrated by the publicly available proof-of-concept [1].

Exploitation

An attacker must have network access to the router's management interface. The attack requires no authentication and can be performed by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a JSON body containing {"topicurl":"setUpgradeFW","resetFlags":"injected_command"}. The injected command is wrapped in backticks, which the shell interprets and executes. The proof-of-concept demonstrates creating a file with ls>./setUpgradeFW.txt to confirm command execution [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the router with root privileges. This can lead to full compromise of the device, including information disclosure, file modification, persistent backdoor installation, or denial of service. The attacker gains complete control over the router, potentially enabling further network attacks.

Mitigation

As of the available information, no official fix or patched firmware version has been released by Totolink. Users should monitor the vendor's website for updates (see [1] for download link). Until a fix is available, if the router is not required to be remotely accessible, disable remote management or restrict access via firewall rules. The device is not listed as known exploited (KEV) per CISA at this time.