Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection

Vulnerability

The vulnerability resides in the UploadOpenVpnCert handler within /cgi-bin/cstecgi.cgi of the Totolink A8000RU router running firmware version 7.1cu.643_b20200521 [1]. The sub_4311C8 function reads the user-supplied FileName parameter and inserts it into a buffer via snprintf; the resulting string is subsequently passed to CsteSystem, which executes it via execv(). No sanitization or validation is performed on the FileName value, enabling OS command injection [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending an HTTP POST request to /cgi-bin/cstecgi.cgi with a crafted JSON payload containing the FileName parameter. The attacker does not require authentication, as demonstrated by the public proof-of-concept (PoC) request [1]. In the PoC, the value \ls>./UploadOpenVpnCert.txt\` is supplied, causing the router to execute the command ls>./UploadOpenVpnCert.txt` [1]. The attacker only needs network access to the device’s web interface [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary OS commands on the router with the privileges of the web server process. This can lead to full device compromise, enabling data exfiltration, modification of configuration, denial of service, or use of the device as a pivot point for further network attacks [1].

Mitigation

As of the publication date, no official firmware update or patch from Totolink has been identified to address this vulnerability [1]. Administrators are advised to restrict network access to the web management interface (port 80/443) from untrusted networks, or disable the interface entirely if not required. The device is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.