CVE-2026-6155

Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection

View on CVE.org
Published Apr 13, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability resides in the setWanCfg function located in /cgi-bin/cstecgi.cgi on the Totolink A7100RU firmware version 7.4cu.2313. By providing a specially crafted value for the pppoeServiceName parameter, an attacker can inject arbitrary operating‑system commands into the router’s command‑line interpreter. This flaw classifies as command injection (CWE‑77) and OS command injection (CWE‑78). The injected commands are executed with the privileges of the web server process, allowing the attacker to read, modify, or delete data, or take full control of the router.

Affected Systems

Any Totolink A7100RU router running firmware 7.4cu.2313 is affected. The exposure occurs through the publicly accessible /cgi-bin/cstecgi.cgi endpoint that accepts the pppoeServiceName argument. Devices with this firmware and remote management enabled or exposed to the Internet are at risk. Other firmware versions or routers from different vendors are not affected per the current data.

Risk and Exploitability

The flaw has a CVSS score of 9.3, indicating critical severity. The EPSS score is 2% and the vulnerability is not listed in the CISA KEV catalog, but a publicly available exploit has already been released, which elevates the likelihood of exploitation. Attackers can remotely trigger the injection by sending crafted HTTP requests to cstecgi.cgi, potentially compromising the entire device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the firmware to the latest version released by Totolink that addresses the command injection vulnerability.
  • If a firmware update is not yet available, block remote HTTP access to /cgi-bin/cstecgi.cgi or disable remote management features.
  • Monitor device logs for unusual requests to cstecgi.cgi to detect exploitation attempts.
  • Ensure network perimeter security to prevent unauthorized access to the router.

Generated by OpenCVE AI on October 25, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 4:29 PM
Reserved
Apr 12, 2026, 6:06 PM

View source JSON

Updated
Apr 14, 2026, 3:20 PM

JSON

Status
Deferred
Published
Apr 13, 2026, 4:16 AM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
Oct 25, 2026, 7:30 PM

JSON