Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection

Vulnerability

An OS command injection vulnerability exists in the Totolink A8000RU router running firmware version 7.1cu.643_b20200521. The flaw resides in the UploadFirmwareFile function within the /cgi-bin/cstecgi.cgi script. The FileName parameter is read from user input and passed through __sprintf_chk into a buffer, which is then processed by the CsteSystem function that ultimately calls execv(). No sanitization is applied to the FileName value, allowing an attacker to inject arbitrary OS commands. The vulnerability can be triggered remotely by sending a crafted POST request to the web management interface [1].

Exploitation

An attacker with network access to the router's web management interface can exploit this vulnerability by sending a POST request to /cgi-bin/cstecgi.cgi with a malicious FileName parameter containing command injection payloads. The proof-of-concept demonstrates setting FileName to ` ls>./UploadFirmwareFile.txt which results in the ls command being executed and its output written to a file. The request uses Content-Type: application/x-www-form-urlencoded` and includes a session cookie, though the vulnerability does not require prior authentication according to the public disclosure [1].

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the router with the privileges of the web server process. This can lead to full compromise of the device, including reading sensitive information, modifying configuration, installing persistent malware, or using the router as a pivot for further network attacks. The proof-of-concept confirms command execution by creating a file with directory listing output [1].

Mitigation

As of the publication date, no official patch has been released by Totolink. Users should restrict network access to the web management interface to trusted networks only, disable remote management if not required, and monitor the vendor's support page for firmware updates. The device may be end-of-life; if so, replacement with a supported model is recommended. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog [1].