Totolink A8000RU OS Command Injection Vulnerability

A critical security vulnerability, identified as CVE-2026-7153, has been discovered in the Totolink A8000RU router, version 7.1cu.643_b20200521. This flaw resides within the CGI Handler component, specifically affecting the setMiniuiHomeInfoShow function located in the /cgi-bin/cstecgi.cgi file. By exploiting this vulnerability, a remote attacker can inject and execute arbitrary operating system commands on the affected device. Public exploits are available, increasing the risk of widespread exploitation. This vulnerability allows unauthenticated remote attackers to gain complete control of the device.

Attack Chain

1. The attacker identifies a vulnerable Totolink A8000RU router running firmware version 7.1cu.643_b20200521.
2. The attacker crafts a malicious HTTP request targeting the /cgi-bin/cstecgi.cgi endpoint.
3. The malicious request includes a manipulated sys_info argument designed to inject an OS command into the setMiniuiHomeInfoShow function.
4. The CGI Handler processes the request, and the vulnerable setMiniuiHomeInfoShow function fails to properly sanitize the sys_info argument.
5. The injected OS command is executed with the privileges of the web server process.
6. The attacker leverages the command execution to gain further access to the system, potentially downloading malware or modifying system configurations.
7. The attacker establishes a persistent backdoor for future access.

Impact

Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary OS commands on the affected Totolink A8000RU router. This could lead to complete device compromise, including modification of router settings, installation of malicious firmware, interception of network traffic, and potential use of the router as part of a botnet. Given the availability of public exploits, a large number of devices are at risk.

Recommendation

• Monitor web server logs for requests to /cgi-bin/cstecgi.cgi containing suspicious characters or command injection attempts in the sys_info parameter to trigger the rule Detect Totolink A8000RU Command Injection Attempt
• Block or quarantine network traffic to and from devices attempting to access /cgi-bin/cstecgi.cgi with potentially malicious payloads.
• Consider deploying a web application firewall (WAF) rule to block requests matching the attack patterns identified in CVE-2026-7153.