Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection

Vulnerability

The Totolink A8000RU router running firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the Web Management Interface. The function setWiFiAdvancedCfg in /cgi-bin/cstecgi.cgi reads the user-supplied bgProtection argument and passes it to Uci_Set_Str and later to CsteSystem, which executes commands via execv(). The lack of sanitization allows arbitrary command injection [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attack involves sending a crafted POST request to /cgi-bin/cstecgi.cgi with a malicious bgProtection parameter containing backtick-enclosed commands. The provided PoC injects ls>./setWiFiAdvancedCfg.txt to demonstrate execution. The attacker must have network access to the router's web interface [1].

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands as root on the router, leading to full compromise. This can result in information disclosure, modification of router settings, denial of service, or use of the device in botnets. The attack achieves remote code execution (RCE) with high impact on confidentiality, integrity, and availability [1].

Mitigation

As of the publication date, no official patch has been released by Totolink. Users should monitor the vendor's download page for firmware updates. In the absence of a patch, restrict access to the web interface to trusted networks only, and consider disabling remote management if not required. The vulnerability is publicly disclosed and a PoC is available, increasing risk [1].