EUVD-2026-20868
GHSA-hh2p-hqf4-c9m6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in addrPrefixLen parameter
-
ExecutionsetIpv6LanCfg processes malicious input
-
ImpactExecute arbitrary commands on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with malicious input in the addrPrefixLen parameter of setIpv6LanCfg function. No authentication, special configuration, or user interaction required. |
| Impact | Critical unauthenticated remote code execution via OS command injection in Totolink A7100RU CGI handler. CVSS 9.8 reflects maximum severity: network-accessible, no authentication required, immediate system compromise. Public exploit availability accelerates organizational risk. Firmware devices with limited patching cycles warrant immediate isolation or replacement. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious payload in addrPrefixLen parameter, injecting OS commands that execute with device privileges. Publicly available exploit code exists enabling trivial weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink official support page (https://www.totolink.net/) for firmware updates beyond October 2019 build. Immediate mitigations: disable IPv6 configuration interface if not operationally required; restrict administrative access to CGI interface via firewall rules permitting only trusted management networks; implement network segmentation isolating vulnerable devices from untrusted networks. Deploy intrusion detection signatures monitoring for command injection patterns targeting /cgi-bin/cstecgi.cgi endpoint. Given publicly available exploit code (https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_159/README.md) and critical CVSS score, prioritize device replacement if vendor discontinues support for affected firmware branch. Consult VulDB advisory for technical details: https://vuldb.com/vuln/356379
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection vulnerability originates from insufficient input validation in setIpv6LanCfg CGI function handling IPv6 LAN configuration parameters. The addrPrefixLen argument accepts unsanitized user input, allowing shell metacharacter injection that executes commands under web server privileges. Attack vector exploits CGI handler's direct system call invocation without parameter escaping or whitelisting.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument addrPrefixLen leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Totolink A7100RU router (version 7.4cu.2313_b20191024 and likely earlier) contains an unauthenticated remote command injection vulnerability accessible via the web interface, allowing attackers to gain complete control of affected devices without credentials. Organizations deploying this router model face immediate risk of network compromise, data exfiltration, and lateral movement into internal infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WAN-side access to the router's web interface; (2) restrict CGI handler access via firewall rules to authorized administrators only; (3) deploy network-based detection for HTTP POST requests targeting /cgi-bin/cstecgi.cgi with addrPrefixLen parameters; (4) segment router from internal systems using VLAN isolation; (5) monitor router logs and network traffic for suspicious command execution patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB