Loading story…
STAR Labs disclosed two unauthenticated command injection flaws in the Prolink PRC2402M router that allow remote attackers to execute arbitrary commands as root via the /cgi-bin/mesh.cgi endpoint. The vulnerabilities, tracked as CVE-2021-35400 and CVE-2021-35407, were verified on firmware version 20190909 and stem from user-controlled input in the key parameter being passed to popen without proper validation. One issue is reachable when page=extender triggers get_extender_page, while the other is exposed when page=upgrade invokes get_upgrade_page.
In both cases, the vulnerable code builds shell commands using router values such as lan_ipaddr together with attacker-supplied input, enabling crafted HTTP GET requests to inject shell syntax and run commands on the device. Prolink was notified of the bugs on June 10, initially said a patch was available the same day, then received a bypass report on June 11 before issuing a final fix on June 13. The disclosures indicate that internet-exposed devices running the affected firmware could be compromised without authentication through the router's web interface.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Prolink ultimately fixed the vulnerabilities on June 13, 2021, resolving the unauthenticated command injection flaws affecting the extender and upgrade code paths in mesh.cgi.
After reviewing the initial fix, STAR Labs reported that the patch could be bypassed, indicating the command injection issues were not fully remediated.
On the same day it was notified, Prolink acknowledged the vulnerability reports and stated that a patch had been applied for the PRC2402M issues.
STAR Labs notified Prolink of CVE-2021-35400 and CVE-2021-35407, two unauthenticated command injection vulnerabilities in the PRC2402M router's /cgi-bin/mesh.cgi handler that could allow root command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two authenticated command injection vulnerabilities in the Prolink `PRC2402M` router that allow arbitrary command execution as `root` on firmware version `20190909`. Tracked as `CVE-2021-35404` and `CVE-2021-35406`, the flaws affect the router's `applogin.cgi` and `login.cgi` handlers, where the `sys_login1` function passes user-controlled input to the system shell without proper validation after a password hash check. In one case, the vulnerable path is triggered with `api=app`; in both cases, the `ipaddr` parameter is central to exploitation, and `lang` is also injectable in the `applogin.cgi` flow. The disclosures say an authenticated attacker can send crafted POST requests to `/cgi-bin/applogin.cgi` or `/cgi-bin/login.cgi` and execute arbitrary commands with full device privileges. STAR Labs reported the issues to Prolink, which initially said a patch was available, but a bypass was then identified and submitted by researcher Daniel Lim before the vendor issued a final fix. The advisories also note that the router's `lighttpd` service processes the requests and that exploit payloads must use CRLF line endings to be accepted in the demonstrated attack path.
Jun 29, 2026
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026