Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection

Vulnerability

The TOTOLINK A8000RU router running firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setDdnsCfg function located in the file /cgi-bin/cstecgi.cgi of the web management interface. The function reads a user-provided parameter provider and passes its value via Uci_Set_Str_By_Idx (defined in libcscommon.so) to the CsteSystem function, which ultimately executes the command using execv() without sanitization. The affected product is TOTOLINK A8000RU, firmware version 7.1cu.643_b20200521 [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi with the parameter provider containing injected OS commands (e.g., wrapped in backticks or quotes). No authentication or prior access is required; the attacker only needs network reachability to the router's web interface. A publicly available proof of concept demonstrates sending a JSON payload with "provider":"ls>./setDdnsCfg.txt" which leads to command execution; the PoC shows a txt` file is created listing directory contents [1].

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the router with the privileges of the web server process (typically root on embedded devices). This can lead to complete compromise of the device, including disclosure of sensitive configuration data, modification of settings, installation of persistent backdoors, or further network attacks from the compromised router.

Mitigation

As of this report, TOTOLINK has not released a patched firmware version for the A8000RU (the affected version is 7.1cu.643_b20200521). The vulnerability is publicly disclosed with exploit code available, and there is no known workaround that does not involve disabling the web management interface entirely. Users should consider isolating the device from untrusted networks or replacing it with a supported model if no update becomes available [1].