Totolink A7100RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A7100RU router, specifically in version 7.4cu.2313_b20191024. The issue resides within the CGI handler file '/cgi-bin/cstecgi.cgi', in the 'UploadFirmwareFile' function. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'FileName' parameter in the HTTP request. The injected commands are executed with root privileges, potentially leading to a full compromise of the router and its connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router, with root privileges. This could lead to a complete takeover of the device and possibly further exploitation of the local network.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'FileName' parameter set to a crafted command, such as 'wget' to download a file from a remote server. The router will execute the command in the background, demonstrating the command injection flaw.