EUVD-2026-19436Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-high real-world risk. The CVSS score of 6.9 reflects low confidentiality, integrity, and availability impact, but the exploitation signals are strong: publicly available exploit code exists, network-reachable unauthenticated access is possible (PR:N), and attack complexity is minimal (AC:L). The presence of public POC code significantly increases the likelihood of mass exploitation against internet-facing Totolink A7100RU devices, particularly given that older consumer router firmware versions often remain unpatched in deployed systems. However, the actual impact is bounded by the permissions of the CGI process-if it runs with limited privileges, command execution damage may be contained. The low impact ratings across confidentiality, integrity, and availability suggest either that the vulnerable endpoint has restricted scope or that the attacker's ability to escalate within the device is limited. |
| Exploit ScenarioDerived | An attacker identifies an internet-facing Totolink A7100RU device on port 80 or 443 and sends an HTTP request to /cgi-bin/cstecgi.cgi with a crafted POST/GET parameter containing shell metacharacters (e.g., resetFlags=test;malicious_command;) that breaks out of the intended command context. Because the CGI process does not validate or escape the input, the injected command executes with the privileges of the web service, potentially allowing the attacker to read sensitive configuration files, modify firewall rules, capture network traffic, or pivot to internal network hosts. Public exploit code on GitHub (https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_184/README.md) lowers the barrier to entry for non-skilled actors, enabling mass scanning and exploitation of unpatched devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Remote command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary OS commands via manipulation of the resetFlags parameter in the CsteSystem function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists for this vulnerability, which achieves a CVSS 6.9 score with low confidentiality, integrity, and availability impact across multiple scopes.
RemediationAI
Immediate remediation requires upgrading the Totolink A7100RU to a patched firmware version released by Totolink after version 7.4cu.2313_b20191024; however, no specific fixed firmware version is confirmed in available data, and users should verify patch availability directly on the Totolink support website (https://www.totolink.net/). As a temporary workaround, restrict network access to the router's web interface by disabling remote management features and implementing firewall rules to limit CGI endpoint access to trusted local networks only. If the vulnerable A7100RU router is internet-facing, immediately isolate it from untrusted networks or power it down until a patched firmware is confirmed available and tested.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Totolink A7100RU router's web-based CGI interface, specifically in the /cgi-bin/cstecgi.cgi script handling the CsteSystem function. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating insufficient input validation or sanitization of the resetFlags parameter before it is passed to OS command execution. The CVSS 4.0 vector confirms network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), suggesting the vulnerable CGI endpoint accepts untrusted input directly in command construction without escaping shell metacharacters. Attackers can inject arbitrary shell commands by crafting malicious resetFlags values that break out of the intended command context.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB