Totolink A8000RU Command Injection Vulnerability in CGI WiFi ACL Rules Handler

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in the version 7.1cu.643_b20200521. The issue arises in the CGI handler file '/cgi-bin/cstecgi.cgi', within the 'setWiFiAclRules' function. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'mode' parameter of a crafted HTTP request. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'mode' parameter set to a command, such as 'ls>./setWiFiAclRules.txt'. The router will execute the command and create a text file with the command output.