Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in version 7.4cu.2313_b20191024. The issue resides within the CGI handler, in a function called 'setTracerouteCfg', located in the file '/cgi-bin/cstecgi.cgi'. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'command' parameter in a crafted HTTP request. The injected commands are executed with root privileges on the device, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'topicurl' parameter set to 'setTracerouteCfg' and the 'command' parameter containing the desired OS command payload. The router will execute the injected command, such as using 'wget' to download a file from a remote server.