CVE-2024-7175: Totolink A3600R Firmware RCE Vulnerability

CVE-2024-7175 Overview

CVE-2024-7175 is an operating system command injection vulnerability in the TOTOLINK A3600R router running firmware version 4.1.2cu.5182_B20201102. The flaw resides in the setDiagnosisCfg function within /cgi-bin/cstecgi.cgi. Attackers manipulate the ipDoamin argument to inject arbitrary shell commands that the device executes. The attack is remotely initiated and requires only low-level privileges on the target. Public disclosure of the exploit technique has occurred through VulDB entry VDB-272596. The vendor was contacted prior to disclosure but did not respond. This weakness maps to [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Remote attackers can execute arbitrary operating system commands on affected TOTOLINK A3600R routers by supplying a crafted ipDoamin parameter, potentially leading to full device compromise and pivoting into internal networks.

Affected Products

TOTOLINK A3600R router hardware
TOTOLINK A3600R firmware version 4.1.2cu.5182_B20201102
Deployments exposing the /cgi-bin/cstecgi.cgi web management interface

Discovery Timeline

2024-07-29 - CVE-2024-7175 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7175

Vulnerability Analysis

The vulnerability affects the setDiagnosisCfg handler exposed through the router's CGI endpoint /cgi-bin/cstecgi.cgi. This handler accepts user-controlled input via the ipDoamin parameter and passes it to an underlying operating system shell without proper sanitization or neutralization of shell metacharacters. An authenticated attacker with low privileges on the network-accessible management interface can inject arbitrary commands. Successful exploitation results in command execution under the privileges of the CGI process, which typically runs with elevated rights on embedded router firmware. Compromised devices can be used to intercept traffic, alter DNS resolution, or serve as staging points for lateral movement into connected networks.

Root Cause

The root cause is missing input validation and improper neutralization of shell metacharacters in the ipDoamin argument processed by setDiagnosisCfg. The firmware concatenates the parameter directly into a shell command string before invocation, allowing operators such as ;, |, and backticks to break out of the intended command context. This pattern is classified under [CWE-78].

Attack Vector

Exploitation requires network access to the router's web management interface and low-privilege credentials. The attacker submits an HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setDiagnosisCfg function with a malicious ipDoamin value containing appended shell commands. No user interaction is required, and the attack completes within a single request. Public technical details are available in the GitHub vulnerability documentation and VulDB entry #272596.

Proof-of-concept technical details describe supplying a crafted ipDoamin parameter within a JSON body to the cstecgi.cgi endpoint. The router passes the string to a system shell where injected metacharacters trigger secondary command execution. Refer to the linked references for the full request structure and payload construction.

Detection Methods for CVE-2024-7175

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setDiagnosisCfg topic with unusual characters in the ipDoamin field such as ;, &&, |, or backticks.
Unexpected outbound connections originating from the router's management plane to external hosts.
New or modified processes spawned by the CGI binary on the device, visible in syslog forwarded from the router.
Configuration changes to DNS, routing tables, or firewall rules that were not initiated by administrators.

Detection Strategies

Inspect HTTP request bodies destined for /cgi-bin/cstecgi.cgi for shell metacharacters within JSON parameter values.
Correlate router syslog events showing child process creation from CGI handlers with inbound web management requests.
Baseline expected management traffic to the router and alert on requests originating from unusual internal or external source addresses.

Monitoring Recommendations

Forward router logs to a centralized logging or SIEM platform and retain them long enough to support investigation.
Monitor for authentication events against the router web UI, particularly successful logins followed by requests to diagnostic endpoints.
Track firmware version inventory across TOTOLINK A3600R devices to identify units still on 4.1.2cu.5182_B20201102.

How to Mitigate CVE-2024-7175

Immediate Actions Required

Restrict access to the router's web management interface so it is not reachable from the WAN or untrusted VLANs.
Change default and shared administrative credentials on all TOTOLINK A3600R devices, and enforce unique strong passwords.
Audit /cgi-bin/cstecgi.cgi access logs for prior exploitation attempts targeting setDiagnosisCfg.
Isolate affected routers on a segmented network until remediation is possible.

Patch Information

No vendor patch is available at the time of writing. The vendor was contacted by the reporter but did not respond to the disclosure. Organizations should monitor the TOTOLINK support portal for firmware updates addressing the setDiagnosisCfg handler and apply them once released.

Workarounds

Disable remote administration on the WAN interface and permit management access only from a dedicated administrative subnet.
Place the router behind an upstream firewall that filters HTTP requests to /cgi-bin/cstecgi.cgi from unauthorized sources.
Replace the affected device with a supported model that receives active security updates if the vendor does not issue a fix.
Apply network access control lists that limit which internal hosts can reach the router's management ports.

bash

# Configuration example: restrict router management access with an upstream firewall (iptables)
# Allow management only from the administrative subnet 10.10.20.0/24
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d <router_ip> --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP