EUVD-2026-21314
GHSA-7796-2cv5-g5f4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in enable parameter
-
ExecutionExecute arbitrary command as router
-
ImpactGain system-level access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU router version 7.4cu.2313_b20191024 by sending crafted requests to /cgi-bin/cstecgi.cgi manipulating the 'enable' parameter in setSyslogCfg function. No authentication or user interaction required. Default configurations vulnerable. |
| Impact | Critical unauthenticated remote code execution via OS command injection in CGI handler affecting Totolink A7100RU routers. CVSS 9.8 reflects maximum severity: network-accessible, no authentication required, trivial exploitation complexity. Elevated observed exploitation activity combined with public exploit availability makes this a priority for immediate patching of affected devices. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS commands injected into the 'enable' parameter of setSyslogCfg function. Publicly available exploit code exists; unauthenticated remote code execution achieves system-level access in single request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. CVSS 9.8 critical severity reflects network accessibility, no complexity barriers, and complete confidentiality/integrity/availability impact. Publicly available exploit code exists, significantly lowering attack barrier for opportunistic scanning campaigns targeting consumer routers.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing this vulnerability per manufacturer site review (https://www.totolink.net/). Immediate mitigations: disable remote administration interfaces, restrict CGI access to trusted internal networks via firewall rules, implement network segmentation to isolate IoT devices. Monitor vendor security bulletins at https://www.totolink.net/ for future firmware updates. Consider replacement with actively maintained router models if vendor remains unresponsive. Detailed exploit analysis available at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_170/README.md and VulDB tracking at https://vuldb.com/vuln/356601.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler due to insufficient input sanitization of the 'enable' parameter in setSyslogCfg function. CVSS vector PR:N confirms unauthenticated remote exploitation. Vulnerable embedded web server directly passes attacker-controlled input to system shell execution context.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Executive ViewAI
Totolik A7100RU routers running version 7.4cu.2313_b20191024 contain a critical remote command injection vulnerability allowing unauthenticated attackers to completely compromise affected devices with publicly available exploit code. Organizations with this router model in their network perimeter or employee home office deployments face immediate risk of network infiltration, data exfiltration, and lateral movement into corporate systems. This vulnerability demands urgent inventory verification and remediation planning given the absence of vendor patches and trivial exploitation barrier.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to router management interfaces via firewall rules blocking inbound traffic to /cgi-bin/cstecgi.cgi; (2) Isolate affected routers on separate VLAN with egress filtering to prevent command exfiltration; (3) Monitor router logs for suspicious setSyslogCfg requests; (4) Implement network IDS/IPS rules to detect exploitation attempts; (5) Escalate support case with Totolik for emergency patch timeline. Hardware replacement remains the recommended long-term control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB