| Title | TOTOLINK NR1800X V9.1.0u.6681_B20230703 Command Injection |
|---|
| Description | A command injection vulnerability exists in the `/cgi-bin/cstecgi.cgi` endpoint due to improper authentication enforcement and insufficient input sanitization. When handling requests associated with the `setTracerouteCfg` action, the application does not properly validate the user's session or cookies before processing the supplied parameters. An attacker can directly send a crafted request to `/cgi-bin/cstecgi.cgi` with `topicurl` set to `setTracerouteCfg` and control the `command` parameter without authentication. Because the value of the `command` parameter is not securely sanitized before being passed to the underlying system command execution logic, an unauthenticated remote attacker may inject and execute arbitrary operating system commands on the affected device. Successful exploitation could result in full device compromise, including arbitrary command execution and potential reverse shell access.
|
|---|
| Source | ⚠️ https://github.com/lxiansheng488-bit/- |
|---|
| User | Anonymous User |
|---|
| Submission | 07/09/2026 11:04 (2 months ago) |
|---|
| Moderation | 08/23/2026 16:23 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 342303 [Totolink NR1800X 9.1.0u.6279_B20210910 POST Request /cgi-bin/cstecgi.cgi setTracerouteCfg command command injection] |
|---|
| Points | 0 |
|---|