Totolink A8000RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue resides within the CGI handler, in the file '/cgi-bin/cstecgi.cgi', particularly in the 'setWiFiBasicCfg' function. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'wifiOff' parameter in a crafted HTTP request. The injected commands are executed with root privileges, potentially compromising the router and the connected network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the router with root privileges, leading to a full compromise of the device. Such access could also be used to further compromise the network to which the router is connected.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'addEffect' parameter set to '1' and the 'wifiOff' parameter containing the payload, such as a command to list directory contents redirected to a file. The router will execute the command and create the specified file with the command output, confirming successful exploitation.