CVE Intelligence
Analysis AI-assisted

CVE-2026-6116: Totolink A7100RU OS Command Injection in setDiagnosisCfg

A vulnerability in the setDiagnosisCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the ip argument, according to the VulDB CNA record. The CNA rates it critical with CVSS v3.1 score 9.8, notes that remote exploitation is possible, and states that an exploit has been publicly disclosed. The CVE is not listed in CISA KEV and the record shows no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-6116 concerns the setDiagnosisCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024. According to the VulDB CNA record, the ip argument is not handled safely and can lead to OS command injection (CWE-77).

Impact

  • The CNA scores the issue as critical with CVSS v3.1 base score 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network attack requiring no privileges or user interaction, with high confidentiality, integrity and availability impact.
  • A successful command injection on an embedded router would generally allow commands to run with the privileges of the vulnerable service. The exact privileges are not stated in the record.

Affected products and versions

  • Product: Totolink A7100RU.
  • Version listed: 7.4cu.2313_b20191024.
  • The affected list in the record is empty, so the status of other versions is unknown. The vendor site is listed as a reference: Totolink.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record.
  • The record states that the exploit has been publicly disclosed and may be used. No confirmed exploitation in the wild appears in the sources consulted.
  • The record gives an EPSS probability of 0.03253 and a percentile of 0.88044.

Remediation and mitigation

  • The record does not provide a fixed version. Check the vendor site for firmware updates for this model and apply any update that addresses this issue.
  • Until a fix is verified, restrict access to the device management interface, disable remote management from untrusted networks, and use segmentation to limit who can reach the CGI interface.
  • If no update is available, consider replacing the device with a supported product.

Detection guidance

  • Review web management access logs for requests to the cstecgi.cgi endpoint from unexpected sources.
  • Monitor the device for unexpected outbound connections or configuration changes.
  • Follow the VulDB entry for updates.

Limitations of the available information

  • The record gives no affected version range, no fixed version and no vendor advisory.
  • The CVSS score comes from the CNA; the record does not show an NVD score.
  • The record includes a third-party repository reference whose contents were not used in this analysis.
  • The EPSS date in the record is later than the publication date, so this metric should be interpreted with caution.

Frequently asked questions

Is CVE-2026-6116 known to be actively exploited?

The record shows it is not listed in CISA KEV and does not confirm active exploitation in the sources consulted. It does state that an exploit has been publicly disclosed and may be used.

What should administrators do first?

Check the vendor for firmware updates, restrict exposure of the management interface, and monitor for suspicious requests, since the record lists no fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.