Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection

Vulnerability

The Totolink A8000RU router firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the web management interface. The function setFirewallType in /cgi-bin/cstecgi.cgi reads the user-supplied firewallType parameter and passes it to the Uci_Set_Str function in libcscommon.so. The value is then inserted into a command string via snprintf and executed by CsteSystem using execv [1]. No input sanitization is performed, allowing arbitrary command injection.

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a malicious firewallType value. The PoC demonstrates using backtick-enclosed commands, such as ` ls>./setFirewallType.txt `, which are executed by the router's operating system [1]. The attack requires network access to the router's web interface; no prior authentication is explicitly required, though the PoC includes a session cookie that may be obtained from an existing session.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the router with root privileges. This can lead to full device compromise, including data exfiltration, installation of malware, and use of the router as a pivot for further network attacks.

Mitigation

As of the publication date, no official patch has been released by Totolink for this vulnerability [1]. Users should restrict network access to the web management interface to trusted hosts only, disable remote management if not needed, and monitor the vendor's support page for future firmware updates.