Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection

Vulnerability

The Totolink A8000RU router running firmware version 7.1cu.643_b20200521 contains an OS command injection vulnerability in the setWanCfg function of the /cgi-bin/cstecgi.cgi script. The enabled parameter is read and passed through Uci_Set_Str_By_Idx and eventually to CsteSystem, which executes the string via execv() without sanitization [1]. An attacker can inject arbitrary OS commands by including them in backticks or other shell metacharacters within the enabled parameter.

Exploitation

An attacker with network access to the router's web interface can send a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with topicurl set to setWanCfg and the enabled parameter containing a command wrapped in backticks (e.g., ` ls>./setWanCfg.txt `). No authentication is required, as the PoC demonstrates successful execution with a session cookie that may not be validated [1]. The command is executed by the system with the privileges of the web server (typically root).

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the router, leading to full device compromise. This can result in unauthorized access to network traffic, modification of router configuration, installation of malware, or use of the device as a pivot point for further attacks on the internal network.

Mitigation

As of the publication date, no official patch has been released by Totolink for this vulnerability. Users are advised to restrict remote access to the router's management interface by disabling WAN-side administration and using firewall rules to limit access to trusted IP addresses. The device may be end-of-life; consider replacing it with a supported model. This CVE is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog.