CVE-2026-6131: Totolink A7100RU OS Command Injection in setTracerouteCfg
CVE-2026-6131 is an OS command injection flaw (CWE-77) in the setTracerouteCfg function of the CGI Handler component of the Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable through /cgi-bin/cstecgi.cgi. The CNA VulDB rates it 9.8 (critical) under CVSS 3.1 and states that it can be exploited remotely and that a public exploit exists. The CVE is not in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
CVE-2026-6131 affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. According to the record, the setTracerouteCfg function exposed through the CGI Handler component at /cgi-bin/cstecgi.cgi does not properly handle the command argument, which allows OS command injection (CWE-77). The record was published on 2026-04-12 by the CNA VulDB.
Impact
- The CNA rates the issue 9.8 (critical) under CVSS 3.1, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network exploitation without privileges or user interaction and high impact on confidentiality, integrity and availability.
- Command injection in a network device can allow an attacker to run operating system commands on the device, so the practical consequences depend on the device configuration and exposure.
Affected products and versions
- Product named in the record: Totolink A7100RU, firmware 7.4cu.2313_b20191024.
- The structured affected-product and affected-version fields in the record are empty, so the full range of affected versions is unknown.
- No fixed version is listed in the record. This does not prove that no fix exists; the vendor site listed in the references should be checked.
Exploitation status
- The CVE is not listed in the CISA KEV catalog in the record.
- The record states that the exploit has been made public and could be used. No confirmed exploitation in the wild appears in the sources consulted.
- The EPSS probability in the record is 0.03253 with a percentile of 0.8806, as reported in the record.
Remediation and mitigation
- Check the vendor site for a firmware update or an advisory for the A7100RU and update to a version that the vendor states is fixed.
- Until a fix is confirmed, limit access to the device management interface, remove exposure of the administrative web interface from untrusted networks and restrict access to trusted administrators.
- Review whether the device is reachable from the internet and, if so, isolate or replace it according to your asset policy.
Detection guidance
- Review web server and CGI access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unfamiliar sources.
- Monitor the device for unexpected outbound connections or configuration changes, and compare its configuration with a known-good baseline.
- Inventory all Totolink A7100RU devices and their firmware versions to find those that match the affected firmware string.
Limitations of the available information
- The record gives no fixed version, no affected version range beyond the single firmware string, and no vendor advisory.
- The record's status field is Deferred, and its meaning is not explained.
- The public exploit referenced by the record is not analyzed here; this content deliberately omits technical exploitation details.
- The record contains an EPSS date of 2026-10-13, which should be verified against the source before use.
Frequently asked questions
What is CVE-2026-6131?
It is an OS command injection vulnerability (CWE-77) in the setTracerouteCfg function of the Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable through /cgi-bin/cstecgi.cgi, according to the record.
Is this vulnerability known to be exploited in the wild?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.