EUVD-2026-21319
GHSA-w3qf-xc88-m8c9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in enable parameter
-
ExecutionsetUrlFilterRules function executes injected command
-
ImpactAchieve remote code execution on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with manipulated 'enable' parameter in setUrlFilterRules function to achieve OS command injection. No authentication or user interaction required. |
| Impact | Critical remote OS command injection in Totolink A7100RU router affecting unauthenticated network access. CVSS 9.8 reflects maximum severity: no authentication required, network-accessible CGI handler, complete system compromise possible. Moderate observed exploitation activity. Public exploit availability and demonstrated POC significantly elevate real-world risk for exposed devices. |
| Exploit ScenarioDerived | Attacker sends crafted HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected in the 'enable' parameter of setUrlFilterRules function. Remote code execution achieved without authentication or user interaction. Publicly available exploit code eliminates technical barriers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction, granting complete device compromise with potential for lateral network movement. Publicly available exploit code exists (GitHub POC). CVSS 9.8 severity reflects network-accessible attack vector with no privilege requirements.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink official site (https://www.totolink.net/) for firmware updates addressing CVE-2026-6027. Until patched firmware is available, implement network segmentation to isolate vulnerable devices from untrusted networks, disable remote administration interfaces, restrict CGI endpoint access via firewall rules permitting only trusted management IPs, and monitor for abnormal outbound connections or command execution patterns. Organizations unable to apply immediate mitigations should consider device replacement with actively maintained alternatives. VulDB advisory: https://vuldb.com/vuln/356603. Technical analysis and POC: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_172/README.md.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 vulnerability stems from insufficient input sanitization in CGI handler's setUrlFilterRules function. The 'enable' parameter undergoes no validation before shell command execution, allowing injection of arbitrary OS commands through metacharacter manipulation. Network-accessible attack surface (AV:N) and absence of authentication barriers (PR:N) enable trivial exploitation via crafted HTTP requests to the CGI endpoint.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution through a critical OS injection flaw, allowing attackers to completely compromise the device and pivot into internal networks. Organizations relying on this router model face immediate risk of network breach and lateral movement without vendor remediation currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable internet-facing access to the router's web management interface via firewall rules; (2) Implement network segmentation isolating the router on a restricted VLAN with minimal trust; (3) Deploy IDS/IPS signatures detecting POST requests to /cgi-bin/cstecgi.cgi with 'enable' parameter payloads; (4) Monitor router logs for abnormal CGI access patterns; (5) Evaluate firmware alternatives from Totolik if available, or replace with router models from vendors maintaining active security update schedules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB