A critical, unauthenticated remote code execution vulnerability in Totolink N300RH routers allows attackers to gain full system control via the web management interface.

This is an OS command injection vulnerability (CWE-78) located in the setUpgradeUboot handler within the upgrade.so file. An unauthenticated remote attacker can inject shell metacharacters into the FileName parameter during a POST request to /cgi-bin/cstecgi.cgi, which are then executed by the system as root.

Successful exploitation of this vulnerability grants an attacker full root access to the affected router, which can lead to complete device compromise, unauthorized network access, and the potential for the device to be leveraged as a pivot point for further attacks on the internal network. Given the CVSS score of 7.3, this represents a significant risk to organizational infrastructure, particularly where these devices are used to provide edge connectivity.

Immediate Action: Update the device firmware to a version beyond V6.1c.1390_B20191101 or apply the latest security patch provided by Totolink. If no patch is available for a specific deployment, isolate the management interface from the public internet immediately.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters like backticks or semicolons in the FileName parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Access Control List (ACL) to restrict access to the router's management interface to known, trusted management IP addresses only.

Public Exploit Available: Yes, a functional proof of concept is available via the referenced GitHub repository.

The presence of a public proof of concept and the ability for an unauthenticated attacker to gain root access makes this a high priority for remediation. Administrators should prioritize firmware updates or network-level isolation of the management interface to prevent unauthorized remote execution.