Totolink A7100RU Command Injection Vulnerability in DDNS Configuration

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the firmware version 7.4cu.2313_b20191024. The issue arises in the web management interface within the 'setDdnsCfg' function of the CGI file '/cgi-bin/cstecgi.cgi'. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'provider' parameter in the HTTP request. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device with root privileges. This could lead to a complete compromise of the router and potentially the network it is connected to.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'topicurl' parameter set to 'setDdnsCfg' and the 'provider' parameter containing the desired command payload, such as a command to download a file using 'wget'. The router will execute the injected command, demonstrating the command injection vulnerability.