Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the version 7.4cu.2313_b20191024. The issue resides within the CGI handler, in a function called setIpv6LanCfg, located in the file /cgi-bin/cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the addrPrefixLen parameter. The injected commands are executed with root privileges, potentially compromising the entire router and its connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /cgi-bin/cstecgi.cgi endpoint with the addrPrefixLen parameter set to a crafted command, such as a wget command that retrieves a file from a remote server. The router will execute the injected command in the background, demonstrating the command injection vulnerability.