Totolink NR1800X Command Injection Vulnerability

A command injection vulnerability has been identified in the Totolink NR1800X router, specifically in the firmware version 9.1.0u.6279_B20210910. The issue arises in the CGI script 'cstecgi.cgi', within the 'setUssd' function. The vulnerability allows remote attackers to inject arbitrary commands by manipulating the 'ussd' parameter, which is then executed by the system command interpreter.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'topicurl' parameter set to 'setUssd' and the 'ussd' parameter containing the injected command payload. Include the 'SESSION_ID' cookie obtained from a previous login request.