Loading story…
STAR Labs disclosed two authenticated command injection vulnerabilities in the Prolink PRC2402M router that allow arbitrary command execution as root on firmware version 20190909. Tracked as CVE-2021-35404 and CVE-2021-35406, the flaws affect the router's applogin.cgi and login.cgi handlers, where the sys_login1 function passes user-controlled input to the system shell without proper validation after a password hash check. In one case, the vulnerable path is triggered with api=app; in both cases, the ipaddr parameter is central to exploitation, and lang is also injectable in the applogin.cgi flow.
The disclosures say an authenticated attacker can send crafted POST requests to /cgi-bin/applogin.cgi or /cgi-bin/login.cgi and execute arbitrary commands with full device privileges. STAR Labs reported the issues to Prolink, which initially said a patch was available, but a bypass was then identified and submitted by researcher Daniel Lim before the vendor issued a final fix. The advisories also note that the router's lighttpd service processes the requests and that exploit payloads must use CRLF line endings to be accepted in the demonstrated attack path.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Prolink fixed the reported authenticated command injection vulnerabilities in the PRC2402M router on 2021-06-13 after reviewing the bypass.
On 2021-06-11, Daniel Lim submitted a bypass showing that Prolink's initial fix did not fully remediate the reported command injection issues.
On the same day it received the report, Prolink acknowledged the vulnerabilities and initially stated that a patch had been made available.
STAR Labs notified Prolink on 2021-06-10 about authenticated command injection vulnerabilities affecting the PRC2402M router, including flaws in applogin.cgi and login.cgi tied to sys_login1 handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two unauthenticated command injection flaws in the Prolink `PRC2402M` router that allow remote attackers to execute arbitrary commands as `root` via the `/cgi-bin/mesh.cgi` endpoint. The vulnerabilities, tracked as `CVE-2021-35400` and `CVE-2021-35407`, were verified on firmware version `20190909` and stem from user-controlled input in the `key` parameter being passed to `popen` without proper validation. One issue is reachable when `page=extender` triggers `get_extender_page`, while the other is exposed when `page=upgrade` invokes `get_upgrade_page`. In both cases, the vulnerable code builds shell commands using router values such as `lan_ipaddr` together with attacker-supplied input, enabling crafted HTTP `GET` requests to inject shell syntax and run commands on the device. Prolink was notified of the bugs on June 10, initially said a patch was available the same day, then received a bypass report on June 11 before issuing a final fix on June 13. The disclosures indicate that internet-exposed devices running the affected firmware could be compromised without authentication through the router's web interface.
Jun 29, 2026
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026