Executive brief
A security vulnerability exists in the Totolink A7100RU home router. This flaw allows a remote attacker to take control of the device by sending a specially crafted request to the router's management interface. Successful exploitation could lead to unauthorized access to the network, interception of data, or a complete shutdown of the device's internet services.
Technical details
An OS command injection vulnerability exists in the /cgi-bin/cstecgi.cgi component of the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024). The vulnerability is located within the setFirewallType function (specifically sub_42DA2C), where the 'firewallType' parameter is improperly sanitized before being passed to the CsteSystem function and subsequently executed via execv(). A remote, unauthenticated attacker can exploit this by sending a crafted JSON POST request containing shell metacharacters (e.g., backticks) to execute arbitrary commands with system privileges. A public Proof of Concept (PoC) demonstrating the use of 'wget' via this vector has been disclosed.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-06: disclosed: Vulnerability and PoC publicly disclosed via GitHub and VulDB.
- 2026-04-06: advisory: CVE-2026-5691 published.