Executive brief
A vulnerability exists in the Totolink A8000RU router, a device used to provide wireless internet connectivity. An attacker can remotely take full control of the router by sending a specially crafted request to its web management interface. This could allow an unauthorized person to intercept network traffic, disrupt internet service, or use the device as a foothold to attack other devices on the local network.
Technical details
An OS command injection vulnerability exists in the 'setQosCfg' function within the '/cgi-bin/cstecgi.cgi' component of the Totolink A8000RU firmware (version 7.1cu.643_b20200521). The vulnerability is rooted in the improper sanitization of the 'enable' parameter. User-provided input is passed to 'snprintf' and subsequently executed via 'execv()' through the 'CsteSystem' function in 'libcscommon.so'. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) to execute arbitrary commands with elevated privileges. A public proof-of-concept (PoC) demonstrating file creation via command injection is available.
Affected products
- Totolink A8000RU 7.1cu.643_b20200521
Timeline
- 2026-05-25: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-05-25: advisory: NVD published the vulnerability details.