CVE-2024-7160: Totolink A3700R Firmware RCE Vulnerability

CVE-2024-7160 Overview

CVE-2024-7160 is a command injection vulnerability in the TOTOLINK A3700R router running firmware version 9.1.2u.5822_B20200513. The flaw resides in the setWanCfg function within /cgi-bin/cstecgi.cgi, where the hostName parameter is passed to a system command without proper sanitization [CWE-77]. Attackers with low-privilege network access can inject arbitrary operating system commands remotely. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts. VulDB assigned identifier VDB-272574 to this issue.

Critical Impact

Authenticated remote attackers can execute arbitrary commands on the router by injecting shell metacharacters into the hostName argument, enabling full device compromise and pivot into the internal network.

Affected Products

• TOTOLINK A3700R router hardware
• TOTOLINK A3700R firmware version 9.1.2u.5822_B20200513
• Deployments exposing the /cgi-bin/cstecgi.cgi interface to untrusted networks

Discovery Timeline

• 2024-07-28 - CVE-2024-7160 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7160

Vulnerability Analysis

The vulnerability exists in the setWanCfg handler exposed through the CGI endpoint /cgi-bin/cstecgi.cgi. When the router processes WAN configuration requests, the hostName parameter supplied by the client is concatenated into a shell command string. Because the input is neither escaped nor validated against a whitelist, shell metacharacters such as ;, |, &&, or backticks are interpreted by the underlying shell. Successful exploitation grants command execution in the context of the CGI process, which typically runs as root on TOTOLINK devices. This provides an attacker with the ability to modify device configuration, extract stored credentials, deploy persistent implants, and use the router as a foothold to reach internal hosts. The EPSS probability of 2.999% places this vulnerability in the 86th percentile for likelihood of exploitation activity.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-77]. The setWanCfg function trusts the hostName value provided over HTTP and passes it directly to a shell interpreter without argument separation or input filtering.

Attack Vector

Exploitation requires network access to the router's web management interface and low-level authenticated access. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setWanCfg action with a hostName value containing shell metacharacters followed by an attacker-supplied command. Because the management interface is often accessible from the LAN by default, an attacker on the same network segment, or an attacker who has compromised any device behind the router, can trigger the flaw.

A proof-of-concept walkthrough is documented in the IoT-vulnerable repository and referenced in the VulDB entry #272574.

Detection Methods for CVE-2024-7160

Indicators of Compromise

• HTTP POST requests to /cgi-bin/cstecgi.cgi containing setWanCfg with shell metacharacters (;, |, `, $() in the hostName field
• Unexpected outbound connections originating from the router itself to unfamiliar hosts
• New or modified processes on the device outside the normal firmware baseline
• Configuration changes to WAN settings that were not initiated by an administrator

Detection Strategies

• Inspect web server or reverse proxy logs for POST requests to cstecgi.cgi with the topicurl=setWanCfg parameter and non-alphanumeric characters in hostName
• Deploy network intrusion detection signatures that match on shell metacharacters within CGI query bodies destined for TOTOLINK management ports
• Monitor DNS queries and outbound TCP connections from router management IPs to identify command-and-control callbacks

Monitoring Recommendations

• Alert on any administrative access to A3700R devices from unexpected source IP ranges
• Baseline the router's outbound traffic and flag deviations, particularly to cloud storage or paste sites
• Aggregate router syslog output to a central collector and correlate CGI access events with configuration changes

How to Mitigate CVE-2024-7160

Immediate Actions Required

• Restrict access to the router's web management interface so it is reachable only from trusted management VLANs
• Disable remote WAN-side administration on the A3700R if it is currently enabled
• Rotate administrator credentials and any shared secrets configured on the device
• Segment the router from sensitive internal assets until a fix is available

Patch Information

The vendor did not respond to the disclosure and no official patch is currently listed in the referenced advisories. Organizations running the TOTOLINK A3700R on firmware 9.1.2u.5822_B20200513 should treat the device as unpatched and consider replacing it with a supported model if a vendor update is not released. Track the VulDB record for updates.

Workarounds

• Place the A3700R behind a firewall that blocks inbound access to TCP ports serving /cgi-bin/cstecgi.cgi from untrusted networks
• Enforce strong administrator passwords and disable default accounts to reduce the reachable attack surface
• Deploy an inline web application firewall rule that drops requests to cstecgi.cgi containing shell metacharacters in POST bodies

# Example iptables rule restricting management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP