CVE Intelligence
Analysis AI-assisted

CVE-2026-6114: Totolink A7100RU OS Command Injection via cstecgi.cgi setNetworkCfg

VulDB has published CVE-2026-6114, an OS command injection flaw in the setNetworkCfg function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The record states the attack can be launched remotely and that a public exploit exists, and the CNA rates it critical with CVSS 3.1 score 9.8. No vendor fix or affected version range is listed in the sources consulted, so administrators should restrict exposure of the device's management interface now.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB catalogued CVE-2026-6114 in the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The issue is located in the setNetworkCfg function reached through /cgi-bin/cstecgi.cgi, part of the CGI Handler component, and is classified as CWE-77 (Command Injection). Details are also tracked in the VulDB entry.

Impact

  • The record states that manipulating the proto argument leads to operating system command injection.
  • The CNA's CVSS 3.1 vector indicates a network attack vector, low complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability. The CVSS 3.1 base score is 9.8.
  • The CNA also provides a CVSS 4.0 score of 8.9, and the record rates the severity as critical.
  • Successful exploitation of a router or gateway would generally allow an attacker to run commands on the device, but the sources do not describe the specific consequences in this product.

Affected products and versions

  • Product: Totolink A7100RU.
  • Version explicitly named in the record: 7.4cu.2313_b20191024.
  • The record does not contain a structured list of affected versions or fixed versions. Whether other firmware builds are affected is unknown from the sources consulted.
  • The Totolink website is the vendor reference listed in the record; no advisory from it is included in the data reviewed.

Exploitation status

  • The record states that the exploit is now public and may be used.
  • CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability is 0.03253 with a percentile of 0.88044, as reported in the record.

Remediation and mitigation

  • No vendor patch or fixed firmware version is identified in the record. The absence of a listed fix does not confirm that none exists; check the vendor site for firmware updates for the A7100RU.
  • Do not expose the router's web or CGI management interface to the internet. Disable remote administration on the WAN side if it is enabled.
  • Restrict management access to trusted internal hosts or a dedicated management network.
  • If no update is available, consider isolating or replacing the device, since a public exploit is referenced in the record.
  • Change default or weak administrative credentials and review the device configuration for unexpected changes.

Detection guidance

  • Review web server or device logs for requests to the cstecgi.cgi endpoint from unexpected or external sources.
  • Monitor for unexpected outbound connections or new network configuration changes originating from the router.
  • Watch perimeter logs for inbound traffic to management ports that should not be reachable from the internet.
  • Where the device allows it, verify its running firmware version against the affected build named in the record.

Limitations of the available information

  • The record gives no affected version range, no fixed version and no vendor advisory.
  • The record references a third-party GitHub repository, but its content was not reviewed for this analysis and is not relied on for technical detail.
  • The NVD record and CVE.org record are listed as source pages, but their full content was not provided beyond the data in this record.
  • Whether the exploit has been used against real systems is unknown from the sources consulted.

Frequently asked questions

Is CVE-2026-6114 being actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit exists and may be used.

Which Totolink A7100RU version is affected?

The record names firmware 7.4cu.2313_b20191024. The sources do not provide a full list of affected or fixed versions.

What should administrators do now?

Check the vendor site for firmware updates, remove remote administration exposure from the internet, restrict management access to trusted hosts, and monitor for unusual requests to the management CGI.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.