Executive brief
A vulnerability exists in the Totolink A7100RU home router, a device used to provide wireless internet connectivity. An attacker can remotely send a specially crafted request to the router's management interface to take complete control of the device. This could allow an unauthorized user to monitor network traffic, disrupt internet service, or use the router as a foothold to attack other devices on the local network.
Technical details
An OS command injection vulnerability exists in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024) within the 'setWiFiGuestCfg' function of the '/cgi-bin/cstecgi.cgi' component. The vulnerability is caused by improper sanitization of the 'wifiOff' parameter. This value is passed to 'snprintf' and subsequently executed via 'execv()' through the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted JSON POST request containing shell metacharacters (e.g., backticks) in the 'wifiOff' field. Successful exploitation results in arbitrary command execution with the privileges of the web server. Public exploit code (PoC) is available.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-10: disclosed: Vulnerability details and PoC published via GitHub and VulDB.