A critical command injection vulnerability in Totolink A3300R routers allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk to network integrity.

The vulnerability exists within the setSyslogCfg function in the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can supply a malicious payload in the rtLogServer parameter, which is improperly sanitized before being passed to a system execution function, resulting in command injection.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized remote control over the affected router. This can lead to complete device compromise, unauthorized access to internal network traffic, and the potential for the router to be leveraged as a pivot point for further attacks against internal assets, potentially resulting in significant data breaches or service disruption. The CVSS score of 7.3 reflects the high risk associated with remote, unauthenticated access.

Immediate Action: Since no official patch is currently identified, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor releases a firmware update.

Proactive Monitoring: Review system and web access logs for unusual POST requests targeting /cgi-bin/cstecgi.cgi, specifically looking for shell-related characters or command execution patterns in the rtLogServer parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to block or flag requests containing suspicious command injection patterns directed at the cstecgi.cgi endpoint.

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to affected Totolink devices. Organizations should prioritize restricting network access to the device management interface immediately. Monitor the vendor support site closely for firmware updates and apply them as soon as they become available to remediate the underlying flaw.