Executive brief
A vulnerability exists in the Totolink A7100RU home router, a device used to provide wireless internet connectivity. An attacker can remotely send a specially crafted request to the router's management interface to take full control of the device. This could lead to the interception of internet traffic, unauthorized access to the local network, or a complete disruption of internet service.
Technical details
An OS command injection vulnerability exists in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024) within the 'setRadvdCfg' function of the '/cgi-bin/cstecgi.cgi' component. The root cause is the improper neutralization of the 'maxRtrAdvInterval' parameter before it is passed to the 'Uci_Set_Str' function and subsequently executed via 'execv()' in the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) in the JSON payload. Successful exploitation allows for arbitrary command execution with the privileges of the web server. Public exploit code (PoC) is available.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-12: disclosed: Vulnerability disclosed via VulDB and GitHub PoC
- 2026-04-12: advisory: CVE-2026-6112 published