Totolink A8000RU Command Injection Vulnerability in Web Management Interface

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue arises within the web management interface, in the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'command' argument in a crafted request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to /cgi-bin/cstecgi.cgi with the 'command' parameter set to a crafted OS command, such as 'ls>./setTracerouteCfg.txt'. The router will execute the command and, in this case, create a text file containing the list of filenames from the directory.