Totolink A7100RU Command Injection Vulnerability

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the 7.4cu.2313_b20191024 version. The issue arises in the web management interface within the 'setRemoteCfg' function of the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter in a crafted HTTP request. The injected commands are executed with root privileges on the device, potentially leading to a full compromise of the router and its connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router, with root privileges. This could lead to a complete takeover of the device and possibly further exploitation of the local network.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'enable' parameter set to a command payload, such as a 'wget' command. The router will execute the injected command in the system's command line interface.