EUVD-2026-21322Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in enable parameter
-
ExecutionExecute arbitrary command on router
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Totolik A7100RU firmware 7.4cu.2313_b20191024 with CGI Handler enabled. Remote unauthenticated attacker sends crafted input to /cgi-bin/cstecgi.cgi setPptpServerCfg function's enable parameter. No authentication or user interaction required. |
| Impact | Critical unauthenticated remote command injection via network access. CVSS 9.8 reflects maximum severity: no authentication required, low attack complexity, complete system compromise. Publicly available exploit code and moderate observed exploitation activity elevate urgency. Totolink A7100RU router users face immediate takeover risk. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with crafted OS commands in the 'enable' parameter to setPptpServerCfg function. Server executes injected commands with router privileges, enabling full device control or data exfiltration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise. Attackers exploit the setPptpServerCfg function in /cgi-bin/cstecgi.cgi CGI handler by injecting malicious commands through the 'enable' parameter. CVSS 9.8 critical severity reflects network-accessible attack requiring no privileges or user interaction. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers seeking router takeover, data exfiltration, or network pivoting.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink support portal (https://www.totolink.net/) for firmware updates beyond 7.4cu.2313_b20191024. Until patched firmware becomes available, implement network-level access controls: restrict administrative interface access to trusted internal networks only, disable remote management features, and deploy firewall rules blocking external CGI endpoint access on TCP ports 80/443. Consider replacing device if vendor discontinues support. Monitor VulDB advisory https://vuldb.com/vuln/356604 and GitHub POC repository https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_173/README.md for remediation updates. Exploitation likelihood elevated due to publicly available exploit code; prioritize mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection in CGI handler's setPptpServerCfg function. Insufficient input sanitization of the 'enable' parameter permits shell metacharacter injection, executing arbitrary system commands with web server privileges. CVSS vector AV:N/AC:L/PR:N confirms remotely exploitable with no authentication barrier. Affects cpe:2.3:a:totolink:a7100ru firmware handling PPTP server configuration endpoints.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that permits complete system takeover without user interaction. Organizations with these devices face immediate risk of network compromise, data exfiltration, and lateral movement into internal systems. This vulnerability requires urgent inventory and remediation due to critical severity, public exploit availability, and lack of vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict WAN access to router management interfaces via firewall ACLs; (2) Isolate affected routers to dedicated VLAN with minimal trusted traffic; (3) Implement network segmentation to limit lateral movement if router is compromised; (4) Deploy IDS/IPS rules to detect suspicious /cgi-bin/cstecgi.cgi requests with 'enable' parameter injection patterns; (5) Monitor router logs for unusual CGI access; (6) Accelerate replacement procurement with alternative vendors pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB