CVE Intelligence
Analysis AI-assisted

CVE-2026-6115: Totolink A7100RU OS command injection in setAppCfg

CVE-2026-6115 is a command injection flaw in the setAppCfg function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU, reported in firmware 7.4cu.2313_b20191024. The record states that manipulating the enable argument can lead to OS command injection, that the attack may be launched remotely, and that a published exploit exists. The CNA CVSS 3.1 base score is 9.8 (critical), but no KEV listing or confirmed exploitation was found in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-6115 affects the setAppCfg function handled by /cgi-bin/cstecgi.cgi (CGI Handler) in the Totolink A7100RU, firmware 7.4cu.2313_b20191024. According to the record, the weakness is classified as CWE-77 (Command Injection) and the flaw is tied to how the enable argument is processed.

Impact

The record describes OS command injection that may be triggered remotely. The CNA scores this as critical, with a CVSS 3.1 base score of 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which indicates high confidentiality, integrity and availability impact if exploited. The CNA also provided CVSS 4.0 (8.9) and CVSS 2.0 (10) scores.

Affected products and versions

  • Product: Totolink A7100RU
  • Version listed in the record: 7.4cu.2313_b20191024
  • Component: CGI Handler, function setAppCfg, file /cgi-bin/cstecgi.cgi

The record's affected list is empty, so other affected versions are not confirmed by the sources consulted. Check the vendor website and the VulDB entry for updates.

Exploitation status

The record states that an exploit has been published and may be used. It is not listed in CISA KEV, so no confirmed active exploitation is reported in the sources consulted. The EPSS probability is 0.03253 (percentile 0.88044) with a date of 2026-10-13.

Remediation and mitigation

  • No fixed firmware version is listed in the record. The absence of a listed fix does not mean none exists; check the vendor at Totolink for updated firmware.
  • Restrict access to the device's web management interface. Do not expose it to the internet, and limit it to trusted management networks.
  • If a vendor patch is unavailable, consider replacing or isolating affected devices according to your risk assessment.
  • Review whether the device is reachable from untrusted networks and remove unnecessary port forwarding.

Detection guidance

  • Monitor web server access to /cgi-bin/cstecgi.cgi for unexpected source addresses or unusual request volume.
  • Review device logs and configuration changes for unexpected modifications to device settings.
  • Watch outbound connections from the device for behavior that differs from its normal baseline.

Limitations of the available information

The record does not include a fixed version, a vendor advisory, a KEV entry, or affected version ranges beyond the single firmware string. The VulDB entry and the public repository referenced in the record were not analyzed in detail here. Details of the exploit are intentionally omitted.

Frequently asked questions

What is CVE-2026-6115?

It is an OS command injection flaw in the setAppCfg function of /cgi-bin/cstecgi.cgi on the Totolink A7100RU, reported in firmware 7.4cu.2313_b20191024.

Is this vulnerability known to be exploited in the wild?

It is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a published exploit exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.