Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the 7.4cu.2313_b20191024 version. The issue resides within the CGI handler, in a function called setRadvdCfg, located in the file /cgi-bin/cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the maxRtrAdvInterval parameter. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the router with root privileges. This could lead to a complete compromise of the device and potentially allow further attacks on the connected network.

Reproduction

To reproduce this vulnerability, send a POST request to the /cgi-bin/cstecgi.cgi endpoint with the maxRtrAdvInterval parameter set to a crafted command, such as one using wget to download a file from a remote server. The router will execute the command, demonstrating the command injection vulnerability.