Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection

The impact of this vulnerability is severe. Successful exploitation allows an attacker to gain complete control over the affected Totolink A7100RU router. This includes the ability to modify router configurations, intercept network traffic, install malware, and potentially pivot to other devices on the network. Given the router's role as a gateway, a compromised device can expose the entire internal network to external threats. The availability of a public exploit significantly increases the likelihood of widespread exploitation, mirroring the rapid spread seen with vulnerabilities like those affecting IoT devices.

Small and medium-sized businesses (SMBs) and home users who rely on the Totolink A7100RU router for their internet connectivity are at significant risk. Shared hosting environments utilizing this router as a gateway are particularly vulnerable, as a compromise could impact multiple tenants. Users with default router configurations or those who have not updated their firmware are also at increased risk.

• linux / server:

journalctl -u cstecgi -g 'pptpPassThru'

• linux / server:

ps aux | grep cstecgi | grep pptpPassThru

• generic web:

curl -I http://<router_ip>/cgi-bin/cstecgi.cgi?pptpPassThru=$(id)

1. 2026-04-09Disclosure

   disclosure

1. Gereserveerd2026-04-08
2. Gepubliceerd2026-04-09
3. Gewijzigd2026-04-13
4. EPSS bijgewerkt2026-04-16

The primary mitigation is to upgrade the Totolink A7100RU firmware to a patched version. Unfortunately, a fixed version is not currently specified. As a temporary workaround, consider implementing strict firewall rules to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted sources. Monitor network traffic for suspicious activity, particularly attempts to access this endpoint with unusual parameters. Implement a Web Application Firewall (WAF) with rules to detect and block command injection attempts targeting the pptpPassThru parameter. After applying any mitigation, verify functionality by attempting to access the router's configuration interface and confirming that the pptpPassThru parameter is properly sanitized.