EUVD-2026-20864
GHSA-323c-322q-9h7v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in enable parameter
-
ExecutionsetUPnPCfg function executes malicious commands
-
ImpactAttacker gains remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with malicious input in the 'enable' parameter of the setUPnPCfg function, executing arbitrary OS commands. No authentication or user interaction required. |
| Impact | CVSS 8.9 with unauthenticated network access and high impact across confidentiality, integrity, and availability. Remote OS command injection in CGI handler poses severe blast radius for exposed routers. Moderate observed exploitation activity and public exploit availability elevate priority despite no KEV confirmation, affecting unpatched A7100RU devices. |
| Exploit ScenarioDerived | Attacker sends unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with crafted OS command payload in 'enable' parameter of setUPnPCfg function. CGI handler executes injected command with device privileges, granting full system access. Publicly available POC code lowers exploitation barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate mitigations: (1) Disable UPnP services if not operationally required via router administration interface; (2) Restrict administrative access to trusted internal networks only-block WAN-side access to management interfaces (TCP/80, TCP/443, CGI endpoints) via firewall rules; (3) Replace device with actively maintained alternative if vendor discontinues support; (4) Monitor vendor security advisories at https://www.totolink.net/ for firmware updates addressing CVE-2026-5851. Technical reference and exploit details available at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_157/README.md and https://vuldb.com/vuln/356377. Given publicly available exploit code, prioritize network segmentation isolating affected devices from untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection stems from insufficient input sanitization in CGI handler's UPnP configuration routine. Attacker-controlled 'enable' parameter passes unsanitized to system shell execution context. CVSS vector confirms unauthenticated remote attack (PR:N, AV:N, AC:L) with proof-of-concept exploitation capability (E:P).
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote code execution via OS command injection, allowing attackers to assume full control of affected devices without authentication. Organizations operating this router model face immediate risk of network compromise, data exfiltration, and lateral movement into connected infrastructure. This vulnerability requires urgent inventory assessment and containment given the high severity, public exploit availability, and absence of vendor patches.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network access controls to restrict external connectivity to affected routers; disable UPnP functionality if not required; deploy WAF or IPS rules to block requests to /cgi-bin/cstecgi.cgi containing 'enable' parameter; isolate affected devices to DMZ with egress filtering; implement continuous monitoring for suspicious command execution on router logs; evaluate immediate replacement with patched hardware from same or alternative vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB