Executive brief
A critical security vulnerability exists in the Totolink A8000RU wireless router, a device used to provide internet connectivity and manage local networks. An attacker can exploit this flaw to take complete control of the router by sending a specially crafted request to its web management interface. This could lead to unauthorized access to network traffic, service disruptions, or the use of the device as a foothold for further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in the Totolink A8000RU router (firmware version 7.1cu.643_b20200521) within the /cgi-bin/cstecgi.cgi component. The vulnerability is located in the setAccessDeviceCfg function, where the 'mac' parameter is improperly sanitized before being processed. Specifically, the user-provided input is concatenated into a buffer and eventually passed to the execv() function via the CsteSystem utility. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) in the 'mac' argument to execute arbitrary commands with elevated privileges. Public exploit code (PoC) has been released.
Affected products
- Totolink A8000RU 7.1cu.643_b20200521
Timeline
- 2026-05-25: disclosed: Initial public disclosure of the vulnerability and PoC.
- 2026-05-25: advisory: NVD and VulDB published the advisory.