Totolink NR1800X Command Injection Vulnerability in Traceroute Configuration Handler

A command injection vulnerability has been identified in the Totolink NR1800X router, specifically in the firmware version 9.1.0u.6279_B20210910. The issue arises in the POST request handler function 'setTracerouteCfg', located in the file '/cgi-bin/cstecgi.cgi'. The vulnerability allows remote attackers to inject commands by manipulating the 'command' parameter, which is not properly sanitized before being executed. This flaw could potentially be exploited to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.