TOTOLINK N300RH Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A critical command injection vulnerability has been identified in the TOTOLINK N300RH router, specifically in the firmware version 6.1c.1390_B20191101. The issue arises in the '/cgi-bin/cstecgi.cgi' file, within the 'setUnloadUserData' function. The vulnerability allows remote attackers to inject and execute arbitrary commands by manipulating the 'plugin_name' argument. This exploitation does not require authentication.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to the '/cgi-bin/cstecgi.cgi' endpoint. Include the 'plugin_name' argument with a payload that exploits the command injection flaw. The request can be made without authentication, and the injected commands will be executed on the router's operating system.