Volerion logoVolerion
Volerion logoVolerion

Totolink A8000RU Command Injection Vulnerability

Vulnerability

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue arises in the 'setAppFilterCfg' function within the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'enable' parameter in a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'enable' parameter set to a command, such as 'ls>./setAppFilterCfg.txt'. The router will execute the command and create a text file containing the command's output.

Added: May 5, 2026, 5:20 AM
Updated: May 5, 2026, 5:20 AM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
7.5
exploitability
9.1
remediation
7.7
relevance
7.3
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.