EUVD-2026-19462
GHSA-h49p-xq2j-gmrw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents significant real-world risk despite a CVSS 6.9 score. The CVSS 4.0 vector confirms network accessibility (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N), indicating broad exploitability. The availability of publicly available exploit code (POC confirmed in input) combined with the unauthenticated, network-accessible attack surface makes this a practical threat to unpatched Totolik routers. The EPSS evidence indicator (E:P) reflects public exploit availability. While the confidentiality, integrity, and availability impacts are marked as low in the CVSS vector (VC:L/VI:L/VA:L), OS command injection on a network device typically permits lateral movement, credential theft, and network pivoting-understating the true impact. Routers are persistent network perimeter devices; compromise facilitates long-term attacks on connected infrastructure. This is a genuine priority for router operators. |
| Exploit ScenarioDerived | An attacker on the public internet identifies a Totolink A7100RU router running vulnerable firmware 7.4cu.2313_b20191024 by scanning for the management interface. The attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious mode parameter containing OS commands (e.g., shell metacharacters or command chains). Because the function does not validate the parameter, the command is executed with the privileges of the web server process, allowing the attacker to read configuration files, modify routing tables, capture network traffic, or establish persistence on the device. The publicly available exploit code lowers the skill threshold for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
OS command injection in Totolink A7100RU firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary commands via manipulation of the mode parameter in the setScheduleCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability, creating immediate risk for exposed devices.
RemediationAI
Contact Totolink support and consult https://www.totolink.net/ for the latest firmware release that patches this vulnerability; no specific fixed version number is provided in the available advisory data. Interim mitigation prior to patching includes restricting network access to the router's web management interface (port 80/443) using firewall rules, disabling remote management features if not required, and isolating the device to trusted networks only. Change default credentials immediately if not already done. Monitor for unauthorized command execution by reviewing router logs for suspicious cgi-bin requests or mode parameters in the schedule configuration endpoint.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from insufficient input validation in a CGI script (cstecgi.cgi) that handles schedule configuration on the Totolink A7100RU wireless router. The setScheduleCfg function fails to properly sanitize the mode parameter before passing it to an OS command execution context, enabling command injection (CWE-78). The attack vector is network-accessible, targeting the web-based management interface of the device. Affected devices are identified by CPE cpe:2.3:a:totolink:a7100ru with firmware version 7.4cu.2313_b20191024 and potentially other versions in the A7100RU product line.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument mode can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB