Totolink A3300R Command Injection Vulnerability

A command injection vulnerability has been identified in the Totolink A3300R router, specifically in version 17.0.0cu.557_b20221024. The issue arises in the 'setStaticRoute' function within the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'ip' parameter in a crafted request. The exploitation takes advantage of unsafe input handling, where the user-supplied 'ip' value is improperly sanitized before being executed as a command.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'ip' parameter set to a crafted command, such as 'wget' to download a file from a remote server. The router will execute the command, demonstrating the command injection vulnerability.