Totolink A8000RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in the 7.1cu.643_b20200521 version. The issue resides within the CGI handler, in the file '/cgi-bin/cstecgi.cgi', particularly in the 'setVpnPassCfg' function. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'pptpPassThru' parameter in a crafted HTTP request. This exploitation occurs without authentication, potentially leading to full compromise of the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'pptpPassThru' parameter set to a command payload, such as a command to list directory contents redirected to a file. The router will execute the injected command and create the specified file with the command output, demonstrating successful exploitation.