EUVD-2026-21318
GHSA-wqxj-7q65-946x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to CGI handler
-
ExploitInject OS command in enable parameter
-
ExecutionExecute arbitrary commands on router
-
ImpactAchieve system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending crafted requests to /cgi-bin/cstecgi.cgi targeting the setPortalConfWeChat function with malicious 'enable' parameter values. No authentication or victim interaction required. |
| Impact | Critical unauthenticated remote code execution via OS command injection in router CGI handler. CVSS 9.8 reflects maximum impact (confidentiality, integrity, availability). Publicly available exploit code and proven exploitation path make this immediately actionable for attackers targeting Totolink A7100RU devices. Elevated observed exploitation activity increases urgency. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected into the 'enable' parameter of setPortalConfWeChat function. Router executes arbitrary commands with device privileges, granting full compromise. No authentication required; publicly available exploit code accelerates attack deployment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability resides in the setPortalConfWeChat function within /cgi-bin/cstecgi.cgi, exploitable by manipulating the 'enable' parameter. CVSS 9.8 severity reflects network-accessible attack vector requiring no authentication or user interaction, with full system compromise potential. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers targeting vulnerable router deployments.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink official website (https://www.totolink.net/) for firmware updates addressing CVE-2026-6026. Until patched firmware becomes available, implement network-level mitigations: disable remote administration interfaces, restrict CGI endpoint access to trusted management networks only via firewall rules, and deploy intrusion prevention signatures targeting command injection patterns in setPortalConfWeChat requests. Consider replacing device if vendor abandons support. Monitor VulDB advisory for patch announcements: https://vuldb.com/vuln/356602. If device exposed to internet, immediately isolate from WAN or decommission until fix available due to publicly available exploit code and unauthenticated remote exploitation risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler due to insufficient input validation on 'enable' parameter in setPortalConfWeChat function. Attacker-controlled input passed to system shell without sanitization enables arbitrary command execution with router process privileges. Network accessibility (AV:N) combined with unauthenticated access (PR:N) creates critical attack surface in embedded device firmware.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setPortalConfWeChat of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument enable results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 and earlier contain a critical unauthenticated remote command injection vulnerability that allows attackers to gain complete system control without authentication. This poses immediate risk to any organization using these routers for network access or management, as exploitation requires only network connectivity and no special privileges. Affected infrastructure should be treated as compromised until patched or replaced.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Segment affected routers behind a firewall with strict ingress rules blocking external access to port 80/443; (2) Disable remote management and web-based administration interfaces if not operationally critical; (3) Monitor router access logs for suspicious CGI requests; (4) Consider replacement with alternative router models pending patch availability. These controls reduce but do not eliminate risk-long-term solution requires patching or hardware replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB