Which versions of A7100Ru are affected by EUVD-2026-21812?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution through a web interface parameter, enabling attackers to gain full device…

Is there a public PoC exploit available for EUVD-2026-21812?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21812. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-21812?

Within 24 hours: Identify all Totolik A7100RU devices in production using network scanning and firmware inventory tools; isolate affected units from production networks if possible. Within 7 days: Contact Totolik support to confirm firmware update availability and timeline; implement network-level access controls restricting WAN access to the /cgi-bin/cstecgi.cgi endpoint. Within 30 days: Deploy firmware updates to version 7.4cu.2313_b20191024 or later once vendor releases a patched build; conduct network traffic analysis for indicators of exploitation against these devices.

A7100Ru EUVD-2026-21812

Q: What is the CVSS score of EUVD-2026-21812?

EUVD-2026-21812 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-6156 HIGH

OS Command Injection (CWE-78)

2026-04-13 VulDB

Command Injection TOTOLINK A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 19:05 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 04:24 vuln.today

Severity Changed

Apr 13, 2026 - 04:22 NVD

CRITICAL HIGH

CVSS changed

Apr 13, 2026 - 04:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 04:15 euvd

EUVD-2026-21812

Analysis Generated

Apr 13, 2026 - 04:15 vuln.today

CVE Published

Apr 13, 2026 - 03:30 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument Comment leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the Comment parameter in the setIpQosRules function exposed through /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with network attack vector, low complexity, and no privileges required. Publicly available exploit code exists (GitHub POC published), significantly lowering the exploitation barrier for opportunistic attackers targeting vulnerable devices.

Technical ContextAI

This vulnerability resides in the CGI handler implementation of Totolink A7100RU consumer router firmware (CPE: cpe:2.3:a:totolink:a7100ru:*:*:*:*:*:*:*:*), specifically in the setIpQosRules function responsible for IP Quality of Service configuration. The flaw represents CWE-78 (OS Command Injection), where inadequate input validation on the Comment parameter allows injection of shell metacharacters. When user-supplied data is passed unsanitized to system() or similar functions in the CGI script at /cgi-bin/cstecgi.cgi, arbitrary commands execute with the privileges of the web server process, typically root on embedded devices. This class of vulnerability is common in legacy router firmware where CGI scripts directly handle network-facing configuration endpoints without proper sanitization frameworks.

RemediationAI

No vendor-released patch identified at time of analysis. Users should immediately check Totolink's official support portal (https://www.totolink.net/) for firmware updates newer than 7.4cu.2313_b20191024 and apply them if available. As interim mitigations: (1) disable remote administration access to the router's web interface from WAN-side networks, restricting management to LAN-only access; (2) implement network-level access controls (firewall rules) to prevent untrusted networks from reaching the CGI interface on TCP ports 80/443; (3) if the device supports it, disable or restrict access to the vulnerable /cgi-bin/cstecgi.cgi endpoint specifically; (4) monitor router logs for suspicious POST requests to setIpQosRules function. Given the age of the affected firmware (2019) and lack of published vendor response, replacement with actively supported hardware may be the most reliable long-term solution for security-sensitive deployments.