A critical command injection vulnerability in the Totolink NR1800X router allows authenticated attackers to gain unauthorized remote code execution on the affected device.

The vulnerability exists within the sub_41A68C function of the cstecgi.cgi script, where the ussd parameter is improperly sanitized before being concatenated into a command string passed to the system shell. An attacker with valid user credentials can trigger this flaw by sending a crafted JSON request to the setUssd endpoint.

Successful exploitation of this vulnerability results in full remote code execution on the network gateway. This allows an attacker to intercept traffic, pivot into internal network segments, or permanently disable the device, leading to significant service disruption and potential compromise of sensitive internal data. With a CVSS score of 8.8, this flaw represents a high risk to organizational security posture.

Immediate Action: Contact the vendor for the latest firmware release, as no public patch is currently confirmed. Until a fix is applied, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at cstecgi.cgi that contain suspicious characters or shell command syntax within the ussd parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or local firewall rules to block access to the management interface for all unauthorized users.

Public Exploit Available: Yes — a functional proof of concept is available via the researcher's GitHub repository.

Given the availability of a public proof of concept and the high potential for full system compromise, administrators must treat this as a high-priority issue. If firmware updates are not immediately available, ensure the router management interface is not exposed to the public internet and enforce strict authentication controls to minimize the attack surface.