A7000R CVE-2026-6168

Authenticated attacker with low-privilege access to TOTOLINK A7000R firmware versions up to 9.1.0u.6115. Attacker sends crafted request to /cgi-bin/cstecgi.cgi setWiFiEasyGuestCfg function with oversized ssid5g parameter. No user interaction required. Remote exploitation possible.

Despite the CVSS 4.0 base score of 7.4 (High severity), real-world risk is elevated by several factors but constrained by access requirements. The CVSS vector (AV:N/AC:L/PR:L) indicates network-based exploitation with low complexity, but requires low-privilege authentication to the router's web interface. The E:P (Proof-of-concept) metric confirms publicly available exploit code exists on GitHub, dramatically reducing attacker effort and enabling script-kiddie level threats. However, the PR:L requirement means attackers must first obtain router credentials through phishing, credential stuffing, or default password exploitation. The attack is not automatable at scale without prior credential compromise. No EPSS score or CISA KEV status is provided, suggesting no confirmed widespread active exploitation. The complete impact triad (VC:H/VI:H/VA:H) means successful exploitation yields full device control-attackers can intercept traffic, pivot to internal networks, or brick the device. For home/SOHO environments with default credentials, this represents critical risk; for hardened enterprise deployments with strong authentication, risk is moderate. The availability of working exploit code and the low attack complexity make this a realistic threat for credential-enabled attackers.

An attacker on the local network or internet (if remote management is enabled) first obtains valid router credentials through credential stuffing against default passwords (admin/admin) or social engineering. After authenticating to the web interface, the attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi, invoking setWiFiEasyGuestCfg with an oversized ssid5g parameter containing shellcode. The stack overflow overwrites the return address, redirecting execution to attacker-controlled code that establishes a reverse shell with root privileges, granting complete control over the router and visibility into all network traffic.