EUVD-2026-20862
GHSA-2vw5-mf9h-8p68
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command via pptpPassThru parameter
-
ExecutionExecute arbitrary system command as router
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending crafted requests to /cgi-bin/cstecgi.cgi with malicious input in the pptpPassThru parameter of the setVpnPassCfg function to achieve OS command injection. No authentication or user interaction required. |
| Impact | CVSS 8.9 reflects unauthenticated network-accessible OS command injection in router management interface. Moderate observed exploitation activity combined with publicly available exploit code creates immediate threat to exposed Totolink A7100RU devices. High impact (confidentiality, integrity, availability) with low attack complexity makes this a critical priority for vulnerable installations. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected in pptpPassThru parameter to setVpnPassCfg function. No authentication required; command executes with device privileges, enabling full system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical).
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing this vulnerability per vendor site review (https://www.totolink.net/). Recommended immediate actions: disable remote management access to CGI interface, restrict administrative access to trusted internal networks only via firewall rules, disable PPTP VPN passthrough functionality if not operationally required. Monitor VulDB tracking page (https://vuldb.com/vuln/356376) and vendor site for future firmware updates. Consider device replacement with actively maintained hardware if vendor does not issue timely patch. Network segmentation should isolate affected devices from critical assets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection in CGI handler's VPN passthrough configuration function. The pptpPassThru parameter lacks input sanitization, enabling shell metacharacter injection into backend OS commands. Router's embedded Linux processes unsanitized CGI input directly in system calls, granting shell-level code execution through web management interface on TCP port typically 80/443.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via the VPN configuration interface, allowing attackers to completely compromise affected devices without credentials or user interaction. Organizations using this router model face immediate risk of network infiltration, data exfiltration, and lateral movement into connected systems. This vulnerability requires urgent inventory verification and isolation of affected devices pending firmware remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to /cgi-bin/cstecgi.cgi endpoint via upstream firewall or WAF rules; (2) Disable WAN access to router admin interface if operationally feasible; (3) Monitor router logs for suspicious requests to setVpnPassCfg function with pptpPassThru parameters; (4) Implement network segmentation to limit lateral movement if device is compromised; (5) Monitor for indicators of compromise including unexpected outbound connections and process execution on router.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB