Totolink A7000R Command Injection Vulnerability in the setUpgradeFW Function

A command injection vulnerability has been identified in the Totolink A7000R router running firmware version 4.1cu.4154. The issue arises in the setUpgradeFW function within the file /cgi-bin/cstecgi.cgi. This vulnerability allows for unauthorized command execution by manipulating the FileName argument. The exploitation can be performed remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized command execution on the affected router.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to /cgi-bin/cstecgi.cgi. Include the FileName parameter in the request body, and manipulate it to execute arbitrary commands. For example, a command to list directory contents could be used.