EUVD-2026-21324Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in User parameter
-
ExecutionsetVpnAccountCfg processes unsanitized input
-
ImpactExecute arbitrary system commands with router privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending crafted input to the setVpnAccountCfg function via /cgi-bin/cstecgi.cgi with OS command injection in the User parameter. No authentication, user interaction, or special configuration required. |
| Impact | Critical unauthenticated remote code execution via OS command injection in router CGI handler. CVSS 9.8 reflects maximum severity: network-accessible, no authentication required, complete system compromise. Publicly available exploit code and moderate observed exploitation activity elevate urgency. Totolink A7100RU devices are directly exposed without mitigation options. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected into setVpnAccountCfg User parameter. Router executes arbitrary commands with full privileges, enabling remote code execution and device takeover. Public exploit code available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. No authentication, low complexity, network-accessible attack vector enables full system compromise with high confidentiality, integrity, and availability impact.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-6029 on official channels (https://www.totolink.net/). Immediate mitigation: disable remote management interfaces, restrict CGI endpoint access via firewall rules permitting only trusted internal networks, disable VPN account configuration features if unused. Organizations should monitor vendor site for firmware updates and consider device replacement if active support has ceased. Consult VulDB entry https://vuldb.com/vuln/356605 and exploit details https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_174/README.md for attack surface understanding to inform network segmentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection vulnerability in CGI handler processes unsanitized User parameter input within setVpnAccountCfg function. Insufficient input validation permits shell metacharacter injection, enabling arbitrary command execution under CGI process privileges on embedded Linux router system.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.
Executive ViewAI
Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical command injection vulnerability allowing unauthenticated attackers to remotely execute arbitrary system commands and fully compromise affected devices. This poses immediate risk to any organization using these routers for network perimeter defense, VPN access, or critical infrastructure connectivity, as attackers can establish persistence, exfiltrate data, and pivot into internal networks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the /cgi-bin/cstecgi.cgi endpoint using firewall rules and access control lists; (2) Disable VPN configuration features if not required; (3) Isolate affected routers to a DMZ with egress monitoring; (4) Monitor for suspicious process execution and outbound connections from router; (5) Implement IPS/IDS signatures blocking requests to setVpnAccountCfg with suspicious User parameter values. Device replacement is strongly recommended given severity and lack of vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB