Totolink A7000R Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Totolink A7000R router running firmware version 4.1cu.4154. The issue arises in the 'CloudACMunualUpdateUserdata' function within the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows for unauthorized command execution by manipulating the 'url' parameter. The exploitation can be performed remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected device, with the potential for executing arbitrary commands with the privileges of the web server.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to '/cgi-bin/cstecgi.cgi' with the 'topicurl' parameter set to 'setting/CloudACMunualUpdateUserdata' and the 'url' parameter containing the command to be executed. This request can be made using a tool like curl or Postman, or through a custom script that automates the process.