A remote command injection vulnerability in the TOTOLINK NR1800X router exposes the device to unauthorized system-level control by authenticated attackers.

The vulnerability is a command injection flaw (CWE-77) located in the setUssd function of the /cgi-bin/cstecgi.cgi file. The application fails to properly sanitize the ussd argument, allowing an attacker with low-level privileges to inject and execute arbitrary system commands.

The ability to inject arbitrary commands into a network device poses a critical risk to organizational security. Successful exploitation could lead to full device compromise, allowing an attacker to intercept network traffic, pivot into internal segments, or establish persistent backdoors. Given the CVSS score of 7.4, this vulnerability represents a high-severity threat that could lead to significant data breaches and operational disruption.

Immediate Action: There is no official patch currently available; administrators should immediately restrict access to the management interface of the affected device to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for suspicious command execution patterns or unauthorized attempts to access /cgi-bin/cstecgi.cgi in web server logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to detect and block malicious payloads targeting the ussd parameter in HTTP requests.

Public Exploit Available: Yes, a technical write-up containing attack details and a proof-of-concept is available via the referenced GitHub repository.

Given the availability of a functional proof-of-concept, the risk of exploitation is elevated. Organizations currently using the TOTOLINK NR1800X should prioritize isolating these devices from external networks and strictly limiting management access to authorized internal personnel until the vendor provides a firmware update.