EUVD-2026-21270
GHSA-3mg5-x6vg-3pmj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in telnet_enabled parameter
-
ExecutionExecute arbitrary commands on router
-
ImpactGain root access to device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by manipulating the telnet_enabled parameter in /cgi-bin/cstecgi.cgi setTelnetCfg function to inject OS commands. No authentication, user interaction, or special configuration required. |
| Impact | Critical unauthenticated remote code execution via OS command injection in Totolink A7100RU router CGI handler. CVSS 9.8 reflects maximum severity: network-accessible, no authentication required, complete system compromise (confidentiality, integrity, availability). Public exploit availability and exploitability rating (E:P) elevate real-world threat. Affects network edge devices with broad attack surface exposure. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with crafted telnet_enabled parameter containing shell metacharacters, bypassing input validation. OS command injection executes arbitrary commands with device privileges, enabling full router compromise, lateral network movement, or credential theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 via unauthenticated manipulation of telnet_enabled parameter in setTelnetCfg function. Critical CVSS 9.8 score reflects network-accessible attack requiring no authentication or user interaction, enabling full system compromise. Publicly available exploit code exists. Impacts router confidentiality, integrity, and availability with potential for complete device takeover and lateral network movement.
RemediationAI
No vendor-released patch identified at time of analysis. Recommended immediate actions: (1) Disable remote administration and CGI access from WAN interfaces via router configuration panel; (2) implement firewall rules blocking external access to /cgi-bin/ paths; (3) disable Telnet service if not operationally required; (4) monitor vendor security advisories at https://www.totolink.net/ for firmware updates; (5) consider replacing device with actively supported model if vendor discontinues security support. Network segmentation isolating affected routers from critical assets reduces lateral movement risk. Public exploit availability (https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_166/README.md) elevates urgency. VulDB reference: https://vuldb.com/vuln/356548
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler (/cgi-bin/cstecgi.cgi) setTelnetCfg function. Insufficient input validation on telnet_enabled argument allows shell metacharacter injection. CVSS vector PR:N confirms unauthenticated remote exploitation. CPE identifies embedded firmware vulnerability in SOHO router platform susceptible to command concatenation attacks.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument telnet_enabled results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical remote command injection vulnerability accessible without authentication, allowing attackers to completely compromise the device and potentially gain access to internal networks. This affects all organizations using this router model in production environments, with immediate risk of unauthorized access, data exfiltration, and lateral movement into corporate or residential networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable remote management protocols (telnet) at network perimeter via firewall rules blocking WAN-to-router management traffic; (2) Restrict router access to trusted administrative subnets only; (3) Implement network segmentation to limit lateral movement from compromised router; (4) Monitor router logs and network traffic for suspicious telnet activity; (5) Consider temporary replacement with patched alternative router model if business-critical; (6) Enable any available router firmware auto-update features as interim measure pending official patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection Flaws
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB