Executive brief
The Totolink A7100RU router, a device used for home and small office networking, contains a critical security flaw in its web management interface. An attacker can exploit this vulnerability to take full control of the router by sending a specially crafted request. This could lead to the interception of internet traffic, unauthorized access to the local network, or a complete shutdown of the device's networking services.
Technical details
An OS command injection vulnerability exists in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024) within the 'setIpQosRules' function of the '/cgi-bin/cstecgi.cgi' component. The vulnerability is rooted in the improper sanitization of the 'Comment' parameter. Specifically, the 'sub_42DEA0' function passes user-supplied input to 'snprintf' to build a command string that is subsequently executed by 'execv' via the 'CsteSystem' function in 'libcscommon.so'. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters in the 'comment' field, leading to full system compromise. Public exploit code (PoC) has been disclosed.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-13: disclosed: Vulnerability details and PoC published on GitHub
- 2026-04-13: advisory: CVE-2026-6156 published by VulDB/NVD