Totolink A8000RU Command Injection Vulnerability in Web Management Interface

A command injection vulnerability has been identified in the Totolink A8000RU router, specifically in version 7.1cu.643_b20200521. The issue resides within the web management interface, in the 'setWanCfg' function of the '/cgi-bin/cstecgi.cgi' file. This vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'enabled' parameter in a crafted request. The exploitation of this vulnerability is publicly documented and could be readily executed.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/cstecgi.cgi' with the 'enabled' parameter set to a command, such as 'ls>./setWanCfg.txt'. The router will execute the command and create a text file containing the command's output.