EUVD-2026-21272Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in lan_info parameter
-
ExecutionExecute arbitrary system commands
-
ImpactAchieve remote code execution on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can inject OS commands via the lan_info parameter in the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware version 7.4cu.2313_b20191024. No authentication or user interaction required. |
| Impact | Critical severity with CVSS 9.8 reflects unauthenticated network-accessible OS command injection enabling full system compromise. Publicly available exploit code exists, significantly reducing attack barriers. Totolink A7100RU router ubiquity in residential/small-business networks amplifies blast radius. No patch evidence identified; firmware updates appear unavailable, leaving affected devices persistently vulnerable. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS commands injected into the lan_info parameter. setMiniuiHomeInfoShow function executes unsanitized input, yielding remote code execution with full device privileges. Public exploit code available on GitHub simplifies attack execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OS command injection in Totolink A7100RU 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via malicious lan_info parameter to setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector requiring no privileges or user interaction. Publicly available exploit code exists. Complete compromise of confidentiality, integrity, and availability achievable through CGI handler manipulation.
RemediationAI
No vendor-released patch identified at time of analysis. Immediately isolate affected Totolink A7100RU devices from untrusted networks. Disable remote administration interfaces and restrict CGI access to trusted management networks only via firewall rules. Monitor vendor advisory page at https://www.totolink.net/ for firmware updates. If device must remain internet-accessible, place behind WAF with strict input validation rules blocking shell metacharacters in lan_info parameter. Consider hardware replacement given exploit availability and lack of confirmed vendor response. Consult VulDB threat intelligence at https://vuldb.com/vuln/356549 and https://vuldb.com/vuln/356549/cti for ongoing threat actor activity monitoring.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler's setMiniuiHomeInfoShow function. Insufficient input validation on lan_info parameter enables shell metacharacter injection, allowing direct system command execution in router firmware's CGI processing path at /cgi-bin/cstecgi.cgi without authentication barriers.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a CGI parameter injection flaw, allowing complete system compromise without authentication or user interaction. Any organization deploying this router model faces immediate risk of unauthorized access, data exfiltration, and network infrastructure takeover. This vulnerability poses a critical threat to network perimeter security and should be treated as a priority incident response and asset inventory concern.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Block external access to /cgi-bin/cstecgi.cgi at network perimeter using WAF or firewall rules; (2) Restrict router management interfaces to authorized IP ranges only; (3) Disable UPnP and remote management features; (4) Monitor router logs for suspicious setMiniuiHomeInfoShow requests; (5) Prioritize replacement or isolation of affected units pending vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection Flaws
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB