A7100ru Firmware

CVEs (34)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-7095	Totolink A7100RU	Cri	0.65	9.8	0.14	Dec 25, 2023	A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag…
CVE-2025-44655	Totolink A7100RU	Cri	0.64	9.8	0.00	Jul 21, 2025	In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
CVE-2023-6906	Totolink A7100RU	Cri	0.64	9.8	0.02	Dec 18, 2023	A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8…
CVE-2023-33556	Totolink A7100RU	Cri	0.64	9.8	0.02	Jun 7, 2023	TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVE-2023-30054	Totolink A7100RU	Cri	0.64	9.8	0.02	May 5, 2023	TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30053	Totolink A7100RU	Cri	0.64	9.8	0.02	May 5, 2023	TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-26978	Totolink A7100RU	Cri	0.64	9.8	0.02	Apr 7, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
CVE-2023-26848	Totolink A7100RU	Cri	0.64	9.8	0.02	Apr 7, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
CVE-2023-27232	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
CVE-2023-27231	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.
CVE-2023-27229	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg.
CVE-2023-27135	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 23, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.
CVE-2023-25395	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 8, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
CVE-2023-24184	Totolink A7100RU	Cri	0.64	9.8	0.01	Feb 21, 2023	TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
CVE-2023-24238	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 16, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 16, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2023-24276	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 6, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVE-2022-48124	Totolink A7100RU	Cri	0.64	9.8	0.02	Jan 20, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
CVE-2022-48123	Totolink A7100RU	Cri	0.64	9.8	0.02	Jan 20, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
CVE-2022-48121	Totolink A7100RU	Cri	0.64	9.8	0.02	Jan 20, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.

CVE-2023-7095CriDec 25, 2023
Totolink
A7100RU
risk 0.65cvss 9.8epss 0.14
A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag…
CVE-2025-44655CriJul 21, 2025
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.00
In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
CVE-2023-6906CriDec 18, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8…
CVE-2023-33556CriJun 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVE-2023-30054CriMay 5, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30053CriMay 5, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-26978CriApr 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
CVE-2023-26848CriApr 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
CVE-2023-27232CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
CVE-2023-27231CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.
CVE-2023-27229CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg.
CVE-2023-27135CriMar 23, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.
CVE-2023-25395CriMar 8, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
CVE-2023-24184CriFeb 21, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.01
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
CVE-2023-24238CriFeb 16, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236CriFeb 16, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2023-24276CriFeb 6, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVE-2022-48124CriJan 20, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
CVE-2022-48123CriJan 20, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
CVE-2022-48121CriJan 20, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.

Page 1 of 2