Description

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T23:17:59.663Z",
  "pubdate": "2026-08-25T23:17:59.663Z",
  "executiveSummary": "This vulnerability is an OS command injection flaw located within the TOTOLINK N600R firmware version 4.3.0cu.7647_B20210106. The vulnerability resides in the /cgi-bin/cstecgi.cgi script specifically within the getCurrentTime function. By manipulating the ntp_server input parameter, an unauthenticated remote attacker can inject and execute arbitrary system commands with the privileges of the web server process. This poses a critical security risk, as successful exploitation allows for full system compromise, unauthorized data access, and potential persistence. Given that the exploit is public, the attack surface is exposed to any actor with network connectivity to the affected device. Immediate remediation is required to prevent remote code execution (RCE) scenarios.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of user-supplied input within the getCurrentTime function found in the /cgi-bin/cstecgi.cgi binary of the TOTOLINK N600R firmware. The application accepts an ntp_server parameter intended for time synchronization configuration; however, it fails to perform adequate input validation or sanitization before passing this string directly to a system-level function or shell execution environment.\nThe attack flow initiates when an attacker sends a specially crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint. By injecting shell metacharacters (such as semicolons, backticks, or pipes) into the ntp_server argument, the attacker can break out of the intended command context. For example, a payload structured as 'ntp_server=; [malicious_command];' forces the underlying operating system to interpret the injected string as a secondary command sequence following the original process execution.\nBecause the web server in this firmware typically runs with high-level privileges (often root), the injected command executes with the same level of authority. This grants the attacker comprehensive control over the device's operating system, enabling them to execute arbitrary binary payloads, modify system configuration files, exfiltrate sensitive network traffic, or establish a reverse shell for persistent unauthorized access.\nThe component affected is the cgi-bin handler, which processes dynamic request parameters. The lack of parameter sanitization allows for arbitrary OS command injection, bypassing intended functional constraints. This is a classic example of improper neutralization of special elements used in an OS command vulnerability. As this interface is accessible via the network, no physical proximity or local access is required to weaponize the vulnerability. The public availability of exploit code significantly lowers the barrier to entry for potential attackers, increasing the likelihood of widespread opportunistic exploitation against vulnerable N600R devices exposed to the internet."
}