CVE Intelligence
Analysis AI-assisted

CVE-2026-6112: Totolink A7100RU OS Command Injection in setRadvdCfg

A command injection weakness (CWE-77) has been reported in the setRadvdCfg function of the Totolink A7100RU, version 7.4cu.2313_b20191024, reachable through the CGI handler at /cgi-bin/cstecgi.cgi. The record describes remote exploitation via the maxRtrAdvInterval argument and states that a public exploit exists. The CNA assigns a CVSS 3.1 base score of 9.8, and no fixed version is listed in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a command injection weakness (CWE-77) in the setRadvdCfg function, handled by the CGI Handler at /cgi-bin/cstecgi.cgi on the Totolink A7100RU, version 7.4cu.2313_b20191024. The vulnerable input is the maxRtrAdvInterval argument. Details are published on VulDB.

Impact

  • The record states that the attack can be initiated remotely.
  • Successful command injection would allow commands to run in the context of the device operating system; the record does not state which privileges would be obtained.
  • The CNA rates the issue CVSS 3.1 9.8 (critical), with high confidentiality, integrity and availability impact in its vector.

Affected products and versions

  • Totolink A7100RU, version 7.4cu.2313_b20191024, is the only version named in the record.
  • The affected and fixes fields of the record are empty, so the full range of affected versions is unknown.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog, so no active exploitation is recorded there. The record states that the exploit has been made publicly available and could be used for attacks. No confirmed exploitation in the wild appears in the sources consulted. EPSS gives a probability of 0.03253 with a percentile of 0.8804.

Remediation and mitigation

  • Check the Totolink website for an updated firmware for this model, since the record does not list a fixed version.
  • Until a fix is confirmed, restrict access to the web management interface and disable remote administration from untrusted networks.
  • Place the device behind a firewall and limit which hosts can reach the CGI endpoints.
  • If the device cannot be updated or isolated, consider replacing it with a supported model.

Detection guidance

  • Review web server and device logs for unexpected requests to the cstecgi.cgi endpoint, especially from unfamiliar sources.
  • Monitor for unexpected outbound connections or configuration changes on the device.
  • Treat any unexplained change to router network settings as a possible compromise and investigate it.

Limitations of the available information

The record does not provide a fixed version, a complete list of affected firmware builds, or vendor confirmation. The source status is recorded as Deferred. The CVSS 4.0 score of 8.9 and CVSS 2.0 score of 10 were supplied by the CNA. Technical exploit details are intentionally not described here.

Frequently asked questions

Is CVE-2026-6112 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit exists, so exposed devices deserve prompt attention.

What should administrators do now?

Check the vendor site for an updated firmware for the Totolink A7100RU, restrict access to the web management interface, and disable remote administration from untrusted networks until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.