CVE Intelligence
Analysis AI-assisted

CVE-2026-6029: Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg OS command injection

CVE-2026-6029 is an OS command injection flaw in the setVpnAccountCfg function of the CGI handler on Totolink A7100RU version 7.4cu.2313_b20191024, reachable remotely through the User argument. VulDB scores it 9.8 (critical) under CVSS 3.1, and the record links a public exploit reference, but the consulted data does not show KEV listing or confirmed exploitation in the wild. No fixed version is listed in the sources, so owners should confirm patch status with the vendor.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-6029 affects the setVpnAccountCfg function exposed by the CGI Handler at /cgi-bin/cstecgi.cgi on Totolink A7100RU version 7.4cu.2313_b20191024. According to the VulDB record, the User argument can be manipulated to achieve operating system command injection, classified as CWE-77. The record states the issue can be triggered remotely.

Impact

  • VulDB rates the CVSS 3.1 base score at 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network access, low complexity, no privileges, no user interaction and high confidentiality, integrity and availability impact.
  • The SSVC data in the record lists technical impact as total and automatable as yes.
  • Command injection on a router would normally run with the privileges of the vulnerable service; the record does not state the exact privilege level.

Affected products and versions

  • Totolink A7100RU, version 7.4cu.2313_b20191024, is the only version listed in the record.
  • No fixed version is listed in the sources consulted.

Exploitation status

  • The record states that an exploit is public and may be used, and it links a third-party GitHub repository tagged as an exploit reference. This analysis does not reproduce or assess that material.
  • The CVE is not listed in CISA KEV in the data provided, so no confirmed active exploitation (exploited in the wild) appears in the sources consulted.
  • The record shows an EPSS probability of 0.03253 (percentile 0.88051) and an SSVC exploitation value of poc (proof of concept).

Remediation and mitigation

  • Identify whether any devices run the A7100RU with the listed firmware version and inventory them.
  • Check with Totolink for firmware updates; no fixed version is identified in the sources.
  • Until a fix is verified, remove remote management exposure from the internet, limit access to the web management interface to trusted networks, and disable VPN account features that are not required.
  • If the device cannot be patched, plan its retirement or replacement, especially where it is reachable from untrusted networks.

Detection guidance

  • Review web server and device logs for unusual requests to the cstecgi.cgi handler, particularly requests related to VPN account configuration.
  • Monitor for unexpected outbound connections, configuration changes or unexplained reboots on the router.
  • Treat new unknown accounts or altered VPN settings as possible indicators of compromise and investigate them.

Limitations of the available information

  • The record does not include a vendor advisory, a fixed firmware version, or confirmation of whether other firmware branches are affected.
  • The record does not describe observed attacks in the wild and does not detail the exact authentication or session requirements beyond the stated remote vector.
  • Scores come from VulDB and its CNA entry; the record does not provide additional scoring context.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the original source.

Frequently asked questions

Which Totolink product and version are affected by CVE-2026-6029?

The record lists the Totolink A7100RU, version 7.4cu.2313_b20191024, as the only affected version.

Is CVE-2026-6029 known to be exploited in the wild?

The CVE is not listed in CISA KEV in the data provided, and the sources consulted do not confirm exploitation in the wild. The record does state that a public exploit reference exists.

What should owners do while no fix is listed?

Restrict remote management exposure, limit web interface access to trusted networks, disable unneeded VPN account features, check the vendor for updates, and retire the device if it cannot be patched.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.