## Summary
Totolink A8000RU (7.1cu.643_b20200521) contains a command injection in the Web Management Interface endpoint /cgi-bin/cstecgi.cgi, specifically in the setWiFiAdvancedCfg handling. A remote attacker can manipulate the bgProtection argument to achieve arbitrary OS command execution.
## Technical Details
- Affected component/function: setWiFiAdvancedCfg in /cgi-bin/cstecgi.cgi
- Vulnerable parameter: bgProtection
- Root cause (as described in the reference):
- bgProtection is read from the request and passed into Uci_Set_Str (from libcscommon.so).
- The value is inserted into an internal buffer via snprintf and then processed by CsteSystem.
- Command execution occurs via execv() inside CsteSystem.
- Exploitation technique:
- Send a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with topicurl set to setWiFiAdvancedCfg.
- Inject shell metacharacters in bgProtection so the resulting string is executed by the router.
## Affected
- Totolink A8000RU version 7.1cu.643_b20200521
- Component: Web Management Interface (/cgi-bin/cstecgi.cgi)
## Impact
- Remote command execution with high impact on confidentiality, integrity, and availability (per CVSS vector AV:N/AC:L/PR:N/.../C:H/I:H/A:H).
- Publicly released exploit/PoC indicates practical attackability.
## Mitigation
1. Patch immediately to a vendor-fixed firmware version for A8000RU (reference includes a vendor download page, but no fixed version is stated in the provided material).
2. Restrict access to the Web Management Interface so /cgi-bin/cstecgi.cgi is not reachable from untrusted networks.
3. Monitor for anomalous POST requests to /cgi-bin/cstecgi.cgi with topicurl=setWiFiAdvancedCfg and suspicious bgProtection values containing shell syntax (e.g., ls>..., backticks).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-77