CVE-2026-6028: Totolink A7100RU OS Command Injection in setPptpServerCfg

Overview

The record describes an OS command injection weakness (CWE-77) in the setPptpServerCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A7100RU 7.4cu.2313_b20191024. The weakness is triggered by manipulation of the enable argument. The CNA is cna@vuldb.com, and the entry was published on 2026-04-10 with source status Deferred. Further details are available at VulDB.

Impact

• The CNA rates the CVSS 3.1 base score at 9.8, severity critical. The CVSS 4.0 score is 8.9 and the CVSS 2.0 score is 10.
• The CVSS 3.1 metrics in the record indicate a network attack vector, low attack complexity, no privileges required and no user interaction.
• The record rates confidentiality, integrity and availability impact as high.
• Successful command injection would allow operating system commands to run in the context of the affected service. The record does not describe specific consequences beyond these ratings.

Affected products and versions

• The record identifies Totolink A7100RU 7.4cu.2313_b20191024 as the impacted product version.
• The structured affected-products field is empty, so no version range is confirmed in the record.
• Whether other firmware builds or versions are affected is unknown from the available data.

Exploitation status

• The record states that the exploit has been disclosed publicly and may be used.
• The CVE is not listed in CISA KEV in the record, so no active exploitation in the wild is confirmed by the sources consulted.
• The EPSS probability is 0.03253 with a percentile of 0.88059, as recorded. EPSS is a statistical estimate of exploitation likelihood, not confirmation of attacks.

Remediation and mitigation

• The record contains no fixed version and no vendor advisory. Check the vendor website at Totolink for updated firmware for this model.
• Until a fix is confirmed, reduce exposure: limit access to the device management interface to trusted internal networks and disable remote administration where it is not needed.
• Review whether the PPTP server feature is in use. If it is not required, keeping it disabled reduces the attack surface.
• Prioritize this device in asset inventories because the CVSS rating and public exploit disclosure raise its urgency, even without KEV listing.

Detection guidance

• Inventory devices running this firmware build and record their network exposure.
• Review web management and CGI request logs for unexpected requests to the cstecgi.cgi endpoint, especially requests touching PPTP server settings.
• Check PPTP server configuration for unexpected changes and compare it with a known-good baseline.
• Monitor for unexpected outbound connections or processes originating from the device, which may indicate command execution.

Limitations of the available information

• The record provides no fixed version, no vendor advisory and no affected version range.
• The CNA's CVSS scores come from the CNA, and no independent NVD analysis is shown in the record.
• The publicly disclosed exploit is referenced but its content is not described here, and this analysis does not provide exploit details.
• The EPSS date in the record is later than the publication date; the value is reported as recorded.

Frequently asked questions

What is the vulnerability in CVE-2026-6028?

The record describes an OS command injection (CWE-77) in the setPptpServerCfg function of the CGI Handler in Totolink A7100RU 7.4cu.2313_b20191024, triggered by the enable argument.

Is this CVE being actively exploited?

The CVE is not listed in CISA KEV in the record, so active exploitation in the wild is not confirmed by the sources consulted. The record does state that a public exploit has been disclosed and may be used.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.