Executive brief
The Totolink A8000RU router, a device used for home and business networking, contains a critical security flaw in its web management interface. An attacker can exploit this vulnerability to take complete control of the router by sending a specially crafted network request. This could lead to the interception of internet traffic, unauthorized access to the local network, or a total disruption of internet services.
Technical details
An OS command injection vulnerability exists in the 'setUrlFilterRules' function within the '/cgi-bin/cstecgi.cgi' component of the Totolink A8000RU router (firmware version 7.1cu.643_b20200521). The root cause is the improper neutralization of the 'enable' argument, which is passed to the 'Uci_Set_Str' function and subsequently executed via 'execv()' through the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) in the JSON payload. Successful exploitation grants the attacker full shell access to the underlying operating system. A public Proof of Concept (PoC) is available.
Affected products
- Totolink A8000RU 7.1cu.643_b20200521
Timeline
- 2026-04-28: disclosed
- 2026-04-28: advisory