Totolink A8000RU Command Injection Vulnerability in CGI Handler

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue resides within the CGI handler, in the file cstecgi.cgi. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'proto' argument in a crafted request. Exploitation of this vulnerability is possible with publicly available methods.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'proto' parameter set to a command, such as 'ls>./setNetworkCfg.txt'. The router will execute the command and create a text file with the command's output.