Totolink A7100RU Command Injection Vulnerability

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the 7.4cu.2313_b20191024 version. The issue arises in the web management interface's CGI handler, '/cgi-bin/cstecgi.cgi', within the 'setFirewallType' function. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'firewallType' parameter. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'firewallType' parameter set to a crafted command, such as 'wget' followed by a URL. The router will execute the command, demonstrating the command injection flaw.