Totolink A8000RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue resides within the CGI handler, in a function called setWiFiEasyCfg, located in the file cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'merge' parameter in a crafted HTTP request. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router with root privileges. This could lead to a complete compromise of the device and potentially the network it is connected to.

Reproduction

To reproduce this vulnerability, send a POST request to the '/cgi-bin/cstecgi.cgi' endpoint. Include the 'merge' parameter in the request body, crafted to inject a command, such as listing directory contents and redirecting the output to a text file on the device. After the request is processed, the injected command will be executed, and the output can be verified by checking the contents of the created text file.