Executive brief
A vulnerability exists in the Totolink A7100RU home router that allows an attacker to take complete control of the device. By sending a specially crafted web request, a remote attacker can execute unauthorized commands on the router's operating system. This could lead to the interception of internet traffic, theft of sensitive data, or the use of the device as a foothold for further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in the CGI handler (`/cgi-bin/cstecgi.cgi`) of the Totolink A7100RU router, specifically within the `setUrlFilterRules` function. The vulnerability is caused by improper neutralization of the `enable` argument before it is passed to the `CsteSystem` function, which eventually executes the input via `execv()`. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) in the JSON payload. Successful exploitation results in arbitrary command execution with the privileges of the web server. A public exploit (PoC) has been disclosed.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-10: disclosed: Vulnerability disclosed via VulDB and GitHub PoC
- 2026-04-10: advisory: NVD published the CVE record