CVE-2026-6025: Totolink A7100RU OS Command Injection in setSyslogCfg
CVE-2026-6025 is an OS command injection flaw in the setSyslogCfg function of the CGI Handler component in Totolink A7100RU firmware 7.4cu.2313_b20191024. The record says that manipulating the enable argument leads to command injection, that the attack can be launched remotely, and that a public exploit is available. The CNA rates it critical with CVSS 3.1 score 9.8, but no fixed version appears in the sources consulted.
Overview
CVE-2026-6025 affects the setSyslogCfg function reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024. According to the record, which lists VulDB as the CNA, manipulating the enable argument leads to OS command injection. The entry was published on 2026-04-10 and its source status is Deferred.
Impact
The CNA assigns CVSS 3.1 score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. The weakness is classified as CWE-77 Command Injection. The same CNA also lists version 4.0 with score 8.9 and version 2.0 with score 10.
A successful command injection on a device management interface would generally allow commands to run in the context of the affected service. This is an inference from the weakness type, not a statement in the record.
Affected products and versions
The description names only Totolink A7100RU 7.4cu.2313_b20191024. The structured affected list in the record is empty, so no version range is confirmed. Whether other firmware builds are affected is unknown.
Exploitation status
The description states that the exploit is publicly available and might be used. The record shows that the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.03253 with a percentile of 0.88039.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean that no fix exists, so check the vendor site at Totolink for firmware updates for the A7100RU.
- Until a vendor fix is confirmed, restrict access to the device web management interface, avoid exposing it to the internet, and place it on segmented management networks.
- Review whether remote administration is enabled and disable it where it is not required.
- If no supported firmware is available, plan for replacement. This is an inference from the absence of fix information.
Detection guidance
- Review web server and device logs for requests to the cstecgi.cgi handler, especially from unexpected sources or with unusual parameter values.
- Monitor the device for unexpected outbound connections or unauthorized configuration changes, including syslog settings.
- Correlate perimeter network telemetry for traffic directed at the device management ports.
Limitations of the available information
The record contains no vendor advisory, no affected version range, no fixed version, and no CVSS source other than the CNA. The title field was empty, so the title here was written from the description. The VulDB entry and a GitHub repository are listed as references, but their contents were not reviewed beyond what the record states. The EPSS date is later than the publication date, so the EPSS values should be read with caution.
Frequently asked questions
Is CVE-2026-6025 listed as actively exploited?
No. The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit is available, which is a separate fact.
Which Totolink versions are affected?
The description names Totolink A7100RU 7.4cu.2313_b20191024. The record has no structured affected range, so other builds cannot be confirmed as affected or unaffected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.