CVE Intelligence
Analysis AI-assisted

CVE-2026-6132: Totolink A7100RU setLedCfg OS Command Injection

CVE-2026-6132 is a command injection flaw (CWE-77) in the setLedCfg function of the CGI Handler component on the Totolink A7100RU, triggered through the enable argument. The CNA reports a CVSS 3.1 base score of 9.8 and states that remote exploitation is possible and a public exploit has been disclosed. The record does not list a fixed version, and this CVE is not in the CISA KEV catalog.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a command injection flaw (CWE-77) in the setLedCfg function of the CGI Handler component, reachable at /cgi-bin/cstecgi.cgi, on the Totolink A7100RU running firmware 7.4cu.2313_b20191024. According to the description, manipulation of the enable argument causes operating system command injection, and remote exploitation is possible.

Impact

  • Successful command injection could allow a remote attacker to run operating system commands on the device. The CNA's CVSS vector indicates network attack vector, no privileges required and no user interaction.
  • The CNA reports high confidentiality, integrity and availability impact under CVSS 3.1 with a base score of 9.8.
  • The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.

Affected products and versions

  • Vendor and product: Totolink A7100RU.
  • Version named in the description: 7.4cu.2313_b20191024.
  • The record's affected list is empty, so the full range of affected versions is unknown.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, so no exploitation in the wild is confirmed by KEV.
  • The description states that the exploit has been publicly disclosed and may be used. No confirmed active exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.03253 and a percentile of 0.8806.

Remediation and mitigation

  • The record lists no fixed version. That absence does not mean no fix exists. Check the vendor website at https://www.totolink.net/ for firmware updates for the A7100RU.
  • Until a verified update is applied, restrict access to the device management interface, keep it off the internet and place it behind network segmentation or filtering.
  • Disable remote administration where it is not required, and verify whether the device model is still supported by the vendor.

Detection guidance

  • Review web management logs for unexpected requests to the CGI handler, particularly those related to LED configuration.
  • Watch for unexpected outbound connections or abnormal device behavior that could indicate command execution.
  • Inventory all A7100RU units, including devices on guest, branch or remote networks.

Limitations of the available information

  • The record has source status Deferred, no affected or fixed version data, and no linked vendor advisory.
  • The record lists scores only from cna@vuldb.com. No other scoring provider data is present.
  • Exploit details are not reproduced in this analysis.

Frequently asked questions

Is CVE-2026-6132 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, so KEV does not confirm exploitation in the wild. The description says a public exploit has been disclosed, but no confirmed active exploitation appears in the sources consulted.

Which Totolink A7100RU version is affected?

The description names firmware 7.4cu.2313_b20191024. The record does not list other affected versions, so the full range is unknown.

Is there a fixed version?

The record lists no fixed version. That does not mean no fix exists, so check the vendor site for firmware updates and restrict management access until one is verified.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.