Technical impact
An OS command injection flaw exists in the setStorageCfg function of /cgi-bin/cstecgi.cgi on Totolink A7100RU routers. By manipulating the sambaEnabled argument, an attacker can execute arbitrary shell commands on the device, potentially taking full control of the router. This allows compromise of confidentiality, integrity, and availability of the network traffic processed by the device, and can serve as a foothold for further attacks on connected infrastructure.
Affected Systems
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are affected. The flaw resides in the CGI Handler component of the firmware.
Risk and Exploitability
The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score of 2% indicates that exploitation is relatively uncommon but not negligible, suggesting that the vulnerability may still be actively exploited in the wild. The description confirms that a public exploit has been released and can be leveraged remotely via an HTTP request to cstecgi.cgi. The likely attack vector is remote through an HTTP request that manipulates the sambaEnabled parameter. Given the high severity and public availability of an exploit, the risk to any exposed device is significant and warrants immediate attention.
