Executive brief
A vulnerability exists in the TOTOLINK N600R wireless router, a device used to provide internet connectivity in homes and small offices. An attacker can remotely take full control of the router by sending a specially crafted request to the Wi-Fi Protected Setup (WPS) configuration settings. This could allow an unauthorized user to intercept network traffic, disrupt internet service, or use the device as a foothold for further attacks on the local network.
Technical details
An OS command injection vulnerability exists in the 'cstecgi.cgi' component of TOTOLINK N600R firmware (specifically versions 4.3.0cu.7647_B20210106 and 4.3.0cu.7866_B20220506). The flaw is located in the setWiFiWpsConfig function (offset 0x41caac) where the 'pin' parameter is insufficiently sanitized before being passed to a system shell command. A remote, unauthenticated attacker can exploit this by sending a crafted JSON request to the 'UploadCustomModule/setWiFiWpsConfig' endpoint containing shell metacharacters (e.g., backticks) in the 'pin' field. Successful exploitation results in arbitrary command execution with the privileges of the web server. Additionally, a related stack-based buffer overflow was identified at offset 0x41ca08 due to unsafe use of strncpy.
Affected products
- TOTOLINK N600R 4.3.0cu.7647_B20210106, 4.3.0cu.7866_B20220506
Timeline
- 2025-08-04: advisory: Initial NVD publication
- 2025-08-05: other: CISA-ADP enrichment and CVSS scoring added