Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection

The Command Injection vulnerability in Totolink A7100RU allows an attacker to inject and execute arbitrary commands on the router's operating system. This is a severe risk because it bypasses normal access controls and grants the attacker the privileges of the system user. Successful exploitation could lead to data theft (configuration files, user credentials), malware installation, and complete control over the router, enabling the attacker to pivot to other devices on the network. The ability to execute arbitrary commands effectively grants the attacker root access, significantly expanding the potential blast radius. This vulnerability shares similarities with other command injection flaws where improper input validation allows attackers to inject malicious code.

Small to medium-sized businesses and home users relying on the Totolink A7100RU router are at risk. Specifically, those with exposed routers or those using default configurations are particularly vulnerable. Shared hosting environments utilizing this router could also be impacted, potentially affecting multiple tenants.

• linux / server:

journalctl -u cstecgi -g 'tty_server' | grep -i 'command injection'

• generic web:

curl -s 'http://<router_ip>/cgi-bin/cstecgi.cgi?tty_server=;id;' | grep -i 'id='

1. 2026-04-10Disclosure

   disclosure

1. 予約済み2026-04-09
2. 公開日2026-04-10
3. 更新日2026-04-14
4. EPSS 更新日2026-04-17

Due to the lack of a provided fixed version, immediate mitigation strategies are crucial. Implement a Web Application Firewall (WAF) rule to filter potentially malicious input to the /cgi-bin/cstecgi.cgi endpoint, specifically targeting the tty_server parameter. Strict input validation should be enforced to prevent the injection of shell commands. Consider temporarily disabling the affected functionality if possible. Monitor router logs for suspicious activity, particularly attempts to access /cgi-bin/cstecgi.cgi with unusual parameters. After a fix is released, upgrade the router firmware to the patched version and verify functionality by attempting to access the affected endpoint with a benign request.