CVE Intelligence
Analysis AI-assisted

CVE-2026-6027: Totolink A7100RU CGI setUrlFilterRules OS Command Injection

A command injection weakness (CWE-77) in the setUrlFilterRules function of the CGI handler on the Totolink A7100RU, version 7.4cu.2313_b20191024, can be triggered remotely through the enable argument. VulDB rates it Critical with CVSS 3.1 score 9.8 and states that a public exploit is available. The record lists no fixed version, and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB has published CVE-2026-6027, an OS command injection weakness (CWE-77) in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi, part of the CGI Handler of the Totolink A7100RU, version 7.4cu.2313_b20191024. According to the record, manipulating the enable argument can lead to OS command injection, and the attack can be launched remotely.

Impact

  • Successful exploitation could allow an attacker to run operating system commands on the device. SSVC assesses technical impact as total.
  • VulDB scores the issue CVSS 3.1 9.8 (Critical), with high confidentiality, integrity and availability impact in the vector.
  • The real-world impact in a given deployment depends on device configuration and exposure, which the record does not describe.

Affected products and versions

  • The only product and version listed is Totolink A7100RU, version 7.4cu.2313_b20191024.
  • The record contains no other affected versions and no fixed version. Scope beyond the listed version is unknown.

Exploitation status

  • The description states that the exploit has been made available to the public and could be used for attacks.
  • This CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted.
  • SSVC records exploitation as poc (proof of concept) and automatable as yes.
  • EPSS is recorded as probability 0.03253 and percentile 0.8805.

Remediation and mitigation

  • The record lists no vendor fix. Check the vendor website for firmware updates for the A7100RU and apply any update that the vendor confirms addresses this issue.
  • If no fix is available, reduce exposure: restrict access to the management interface to trusted networks, disable remote administration where possible, and segment the device from sensitive systems.
  • Treat the device as a priority asset while the issue remains open, and consider replacing unsupported hardware.

Detection guidance

  • Monitor web management traffic to /cgi-bin/cstecgi.cgi and flag requests from untrusted sources or at unusual times.
  • Review device logs and configuration for unauthorized changes to URL filter settings or unexpected system behavior.
  • Watch for unexpected outbound connections from the router, which can indicate compromise.

Limitations of the available information

  • The record contains no vendor advisory, no vendor confirmation and no fixed version.
  • The exploit repository is cited as a reference only; this analysis does not assess its content.
  • Preconditions beyond remote reachability are not fully described. The VulDB reference tags include permissions-required, but the record does not state which permissions are needed.

Frequently asked questions

Is CVE-2026-6027 being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The description states that a public exploit is available, so the risk of exploitation is elevated.

Which product and version are affected?

The record lists the Totolink A7100RU, version 7.4cu.2313_b20191024. No other versions are listed.

Is there a fixed version?

The record does not list a fixed version. Check the vendor for firmware updates, since a missing entry in the record does not mean no fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.