Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection

Vulnerability

A command injection vulnerability exists in Totolink A8000RU firmware version 7.1cu.643_b20200521 within the Web Management Interface. The function setAccessDeviceCfg in /cgi-bin/cstecgi.cgi reads the user-supplied mac parameter and passes it to Uci_Add_List via strcat. The value is then processed by CsteSystem, which ultimately calls execv(), allowing arbitrary OS commands to be executed. No authentication is required to trigger this vulnerability [1].

Exploitation

An unauthenticated attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi with a JSON body containing "topicurl":"setAccessDeviceCfg" and a mac parameter containing a command injection payload enclosed in backticks. For example, setting mac to ` ls>./setAccessDeviceCfg.txt causes the router to execute the ls` command and write the output to a file. The exploit has been publicly released [1].

Impact

Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the web server process, typically root. This can lead to full compromise of the router, including data exfiltration, installation of malware, and use of the device as a pivot point for further network attacks [1].

Mitigation

As of the publication date, no official firmware update has been released by Totolink to address this vulnerability. Users should restrict access to the web management interface to trusted networks only, disable remote management if possible, and monitor for vendor updates. The public availability of a proof-of-concept exploit increases the risk of active exploitation [1].