CVE-2026-6026: Totolink A7100RU OS Command Injection in setPortalConfWeChat
A command injection flaw (CWE-77) was reported in the setPortalConfWeChat function of the Totolink A7100RU firmware 7.4cu.2313_b20191024, reached through the CGI handler at /cgi-bin/cstecgi.cgi. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), and the record states that an exploit has been released publicly. The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
Overview
A security flaw was reported in the setPortalConfWeChat function of the CGI Handler component of the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The function is reached through /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77 (Command Injection), meaning input handled by the function may reach an operating system command without adequate neutralization. Source: NVD record and VulDB entry.
Impact
- The CNA rated the issue with CVSS 3.1 base score 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which corresponds to critical severity.
- The CNA also provided a CVSS 4.0 score of 8.9.
- The vector indicates a network attack with no privileges and no user interaction, and high impact to confidentiality, integrity and availability. Exposed devices are therefore the highest concern (inference from the vector).
Affected products and versions
- Product named in the record: Totolink A7100RU, firmware version 7.4cu.2313_b20191024.
- The record's affected and fixes lists are empty. The affected range beyond the named build is unknown, and no fixed version is listed in the sources consulted.
Exploitation status
- The record states that an exploit has been released to the public and may be used for attacks.
- The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed active exploitation appears in the sources consulted.
- The record provides an EPSS probability of 0.03253 with a percentile of 0.88039.
Remediation and mitigation
- Check the vendor website at Totolink for firmware updates for the A7100RU and apply any update that addresses this issue. No specific fixed version is confirmed in the sources reviewed.
- Until an update is verified, restrict access to the device management interface. Do not expose it to the internet, place it behind network controls, and limit administrative access to trusted hosts.
- Identify devices reachable from untrusted networks and treat them as priorities for isolation or replacement.
- Where vendor updates are unavailable, consider retiring the device from exposed roles.
Detection guidance
- Monitor network logs for unexpected requests to the CGI handler on affected devices, especially from sources that are not administrative.
- Watch for unexpected outbound connections or configuration changes on the device that could indicate command execution.
- Keep an inventory of Totolink A7100RU devices with firmware build information to support triage.
Limitations of the available information
- The record does not include affected version ranges, fixed versions, or vendor advisory text.
- The source status is marked as Deferred, so details may change as sources are updated.
- The technical description comes from the VulDB entry and the NVD record. The third-party repository linked in the record was not used as a basis for this analysis.
Frequently asked questions
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that an exploit has been released publicly.
How severe is it?
The CNA assigned a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 8.9. These scores are taken from the CNA record.
Is there a fixed version?
The record lists no fixed version. Check the vendor website for updates and treat the fix status as unknown until it is verified.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.