TOTOLINK X5000R Command Injection Vulnerability in cgi-bin/cstecgi.cgi

A command injection vulnerability has been identified in the TOTOLINK X5000R router, specifically in version 9.1.0cu.2415_B20250515. The issue arises in the function sub_410C34 of the file cgi-bin/cstecgi.cgi, where manipulation of the 'pid' argument allows for remote command execution. This vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the cgi-bin/cstecgi.cgi endpoint. The request must include a 'pid' parameter with a crafted value that exploits the command injection flaw, such as a command followed by output redirection. Additional required parameters include 'topicurl' and 'token'.