A7100Ru EUVD-2026-21702

Remote unauthenticated attacker can exploit CVE-2026-6113 against Totolik A7100RU firmware version 7.4cu.2313_b20191024. Requires network access to the CGI Handler endpoint /cgi-bin/cstecgi.cgi. No authentication or victim interaction needed. Attacker manipulates the ttyEnable parameter in setTtyServiceCfg function to inject OS commands.

This vulnerability presents critical real-world risk based on converging threat signals. The CVSS 9.8 score reflects maximum severity across attack vector (AV:N - network accessible), attack complexity (AC:L - low, no special conditions required), privileges required (PR:N - none, unauthenticated), user interaction (UI:N - none needed), and complete impact to confidentiality, integrity, and availability. The CVSS temporal metric E:P (Proof-of-concept Exploit) confirms publicly available exploit code, substantiated by the GitHub repository reference containing functional POC. While no CISA KEV listing indicates confirmed mass exploitation campaigns, the combination of pre-authentication RCE, public POC, and typical router deployment patterns (internet-facing management interfaces) creates high probability of active scanning and exploitation. SSVC decision tree would classify this as 'act now' given: exploitation status (POC public), automatable (yes - can be scripted against IP ranges), technical impact (total system compromise). The absence of vendor patch information combined with Totolink's historically limited security response significantly elevates risk for deployed devices. Real-world threat is immediate for any A7100RU devices with web management accessible from untrusted networks.

An unauthenticated attacker scans internet IP ranges for Totolink A7100RU routers with exposed web management interfaces on port 80/443. Upon identifying a target, the attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious ttyEnable parameter value containing shell metacharacters and injected commands (e.g., backticks or semicolons with command payloads). The vulnerable setTtyServiceCfg function processes this input without sanitization, executing the attacker's commands with root privileges. The attacker establishes persistent access via reverse shell, modifies DNS settings to redirect traffic, installs cryptomining malware, or pivots to internal network devices. Public POC availability on GitHub enables low-skill attackers to automate exploitation across vulnerable device populations.