Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in the 7.4cu.2313_b20191024 version. The issue arises within the CGI handler, in the 'setDiagnosisCfg' function of the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'ip' parameter in a crafted HTTP request. The injected commands are executed with root privileges on the device, potentially leading to a full compromise of the router and its connected network.

Impact

Exploitation of this vulnerability allows for unauthorized remote execution of operating system commands with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'ip' parameter set to a command payload, such as a 'wget' command. The router will execute the injected command, demonstrating the command injection vulnerability.