Description

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-31T01:16:50.190Z",
  "pubdate": "2026-08-31T01:16:50.190Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the TOTOLINK NR1800X router, specifically within the firmware version 9.1.0u.6681_B20230703.\nThe vulnerability resides in the setUssd function located within the /cgi-bin/cstecgi.cgi component.\nThis flaw allows an unauthenticated, remote attacker to execute arbitrary system commands with elevated privileges by injecting malicious payloads into the ussd argument.\nSuccessful exploitation poses a significant security risk, potentially leading to a complete compromise of the router, unauthorized access to network traffic, or integration of the device into a malicious botnet.\nGiven that exploit code is publicly available, the probability of active exploitation is high.\nDefensive measures must be prioritized to restrict remote access and monitor for anomalous execution patterns within the device's CGI environment.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw occurring within the /cgi-bin/cstecgi.cgi script. The underlying root cause is the improper neutralization of user-supplied input provided to the ussd argument before it is passed to a system-level process or shell execution function within the setUssd routine.\nWhen a request is submitted to /cgi-bin/cstecgi.cgi, the backend binary parses the input parameters. The setUssd function fails to adequately sanitize the ussd input, allowing characters with shell-metacharacter significance (such as semicolons, backticks, or pipes) to be interpreted by the underlying command interpreter.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP request (typically a POST or GET request depending on the CGI implementation) targeting /cgi-bin/cstecgi.cgi. By embedding shell commands within the ussd parameter—for instance, using command delimiters like '; [command] #'—the attacker forces the router's operating system to execute the injected payload with the privileges of the web server process, which often runs with root or administrative permissions.\nBecause the interface is reachable remotely, the attack does not require physical proximity or pre-existing authentication, significantly increasing the potential attack surface. The payload execution happens synchronously, where the injected command is processed immediately upon the request being handled by the vulnerable function.\nThe post-exploitation impact includes the ability to modify system configurations, exfiltrate sensitive data, gain persistent access to the network infrastructure, or effectively disable the device (Denial of Service). As the vulnerability is located in the CGI handler, it bypasses standard application-layer security controls, directly interacting with the host system's shell environment.\nThis vulnerability highlights a failure in input validation and the dangerous use of insecure system API calls (such as system(), popen(), or exec variants) without proper parameterization or strictly defined allow-listing of input characters. The lack of robust input encoding and character filtering allows the bypass of intended function logic, leading to full system command execution."
}