CVE-2026-6154

Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection

View on CVE.org
Published Apr 13, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed
Description
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

A flaw in the setWizardCfg function of the /cgi-bin/cstecgi.cgi component allows remote manipulation of the wizard argument to inject and execute arbitrary operating system commands. This leads to complete compromise of the device’s control plane, granting an attacker full administrative privileges. The weakness aligns with OS command injection problems documented as CWE‑77 and CWE‑78.

Affected Systems

All Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024 are affected. The vulnerability is specific to the CGI Handler element present in these devices.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.3, indicating critical severity. EPSS score is 2%, and the vulnerability is not listed in CISA’s KEV catalog, but a public exploit has been released, suggesting the attack vector is remote and exploitable over the network. An attacker can simply send a crafted request to the affected endpoint to execute arbitrary commands, with no local privileges required.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Totolink that addresses the setWizardCfg injection flaw.
  • If a patch is not yet available, block or disable the /cgi-bin/cstecgi.cgi endpoint using the router’s firewall or access control settings.
  • Restrict external access to the router’s management interface and enforce strong authentication.
  • Monitor device logs for anomalous command execution patterns or unexpected use of the setWizardCfg interface.

Generated by OpenCVE AI on October 25, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 13, 2026, 3:03 PM
Reserved
Apr 12, 2026, 6:05 PM

View source JSON

Updated
Apr 13, 2026, 3:03 PM

JSON

Status
Deferred
Published
Apr 13, 2026, 4:16 AM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 7:30 PM

JSON