CVE-2026-6113: Totolink A7100RU OS Command Injection in CGI Handler
A command injection flaw (CWE-77) has been reported in the CGI Handler of the Totolink A7100RU, firmware 7.4cu.2313_b20191024, within the setTtyServiceCfg function. The CNA VulDB rates it 9.8 under CVSS 3.1 and describes remote exploitation, with an exploit disclosed publicly. The record does not show a KEV listing or an official fixed version.
Overview
CVE-2026-6113 is recorded against the Totolink A7100RU, firmware 7.4cu.2313_b20191024. According to the record, the flaw is in the setTtyServiceCfg function reached through the CGI Handler component at /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77, Command Injection, and the CNA VulDB published it on 2026-04-12 with a status of Deferred.
Impact
- The record describes the flaw as allowing operating system command injection through the ttyEnable argument.
- The CNA scores it 9.8 under CVSS 3.1 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges and no user interaction required.
- Successful command injection on a router would generally allow an attacker to act with the privileges of the affected service, but the record does not state the exact privilege level or the resulting consequences.
Affected products and versions
- The description names the Totolink A7100RU, version 7.4cu.2313_b20191024.
- The structured affected-product list in the record is empty, so no broader version range is confirmed.
- No fixed version is listed in the record.
Exploitation status
The record states that the exploit has been disclosed publicly and may be used. The CISA KEV catalog entry is marked as not listed, so the sources consulted do not confirm exploitation in the wild or active exploitation. The EPSS probability is 0.03253 with a percentile of 0.88042, dated 2026-10-13.
Remediation and mitigation
- Identify any Totolink A7100RU devices in your environment and confirm their firmware version.
- Check the vendor site and the vulnerability database entries for an updated firmware release, since the record does not provide one.
- Until a fix is confirmed, reduce exposure: remove management interfaces from the internet, restrict administrative access to trusted networks, and replace devices that are no longer supported.
- Change default administrative credentials and review access logs for unexpected administrative requests.
Detection guidance
- Monitor web management traffic to the device for unusual requests to the CGI endpoint and for unexpected administrative configuration changes.
- Review device logs and network telemetry for unexpected outbound connections or new processes originating from the router.
- Alert on configuration changes to the TTY or service settings that were not made by authorized administrators.
Limitations of the available information
The record does not include vendor advisory text, a confirmed fixed version, an affected version range beyond the single firmware string, or evidence of exploitation in the wild. The title was not supplied and was written from the description. Scores from CVSS 4.0 and 2.0 are present in the record, but the vector strings for those versions are not provided.
Frequently asked questions
Is CVE-2026-6113 known to be actively exploited?
The record does not list it in CISA KEV, and the sources consulted do not confirm exploitation in the wild. The record does state that a public exploit has been disclosed and may be used.
Which Totolink devices are affected?
The description names the Totolink A7100RU with firmware 7.4cu.2313_b20191024. The structured affected-product list is empty, so other versions are not confirmed.
Is there a fixed version?
No fixed version appears in the record. Check the vendor and the vulnerability database for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.