Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the 7.4cu.2313_b20191024 version. The issue resides within the CGI handler, in a function called setLoginPasswordCfg, located in the file /cgi-bin/cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the admpass parameter. The commands are executed with root privileges, potentially leading to a full compromise of the router and its connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /cgi-bin/cstecgi.cgi endpoint. Include the admpass parameter in the request body, crafted to inject a command, such as one using wget to download a file from a remote server. Once the request is processed, the injected command will be executed on the router.