CVE-2026-6138: Totolink A7100RU OS Command Injection in setAccessDeviceCfg

Overview

A vulnerability classified as CWE-77 (Command Injection) was reported in the setAccessDeviceCfg function of /cgi-bin/cstecgi.cgi in the CGI Handler component of the Totolink A7100RU, identified in the record as version 7.4cu.2313_b20191024. According to the record, manipulating the mac argument leads to operating system command injection, and the attack can be initiated remotely. The details are summarized from the CVE record and the VulDB entry.

Impact

• Successful command injection could allow an attacker to run operating system commands on the device with the privileges of the vulnerable process.
• The CNA VulDB assigned CVSS 3.1 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack, low complexity, no privileges and no user interaction.
• The record does not describe further consequences, such as persistence or movement to other systems.

Affected products and versions

• Product: Totolink A7100RU.
• Version named in the record: 7.4cu.2313_b20191024.
• The record's affected and fixes lists are empty, so the full range of affected versions and any fixed version are unknown from the sources consulted.

Exploitation status

• The CNA description states that the exploit has been published and may be used.
• The record shows CISA KEV as not listed, so no active exploitation or exploitation in the wild is confirmed in the sources consulted.
• The record reports an EPSS probability of 0.03253 and a percentile of 0.88055.

Remediation and mitigation

• No vendor fix is listed in the record. Check the Totolink website for firmware updates for the A7100RU and apply any updates the vendor publishes.
• Restrict access to the device web management interface to trusted administrative networks, and disable remote management where it is not required.
• Place the device behind network segmentation so that it is not directly reachable from untrusted networks.
• Inventory devices running the listed firmware version and prioritize them for review.

Detection guidance

• Review web server and device logs for unusual requests to the cstecgi.cgi endpoint, especially requests with abnormal values in device configuration fields.
• Monitor the device for unexpected outbound connections, unexpected restarts or unexplained configuration changes.
• Use network monitoring to flag management-interface traffic from sources that are not expected administrators.

Limitations of the available information

• The record does not list affected or fixed version ranges, vendor advisory text, or confirmed exploitation events.
• The record also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10 from the CNA, without vector details.
• The EPSS date in the record (2026-10-13) is later than the publication date; it is reported as recorded.
• This analysis does not describe exploit mechanics, and the sources consulted do not provide them.

Frequently asked questions

What is CVE-2026-6138?

It is a command injection vulnerability (CWE-77) in the setAccessDeviceCfg function of the Totolink A7100RU CGI Handler, triggered through the mac argument.

Is this CVE known to be actively exploited?

The record shows no CISA KEV listing and no confirmed active exploitation in the sources consulted, although the CNA states that a public exploit has been published.

What should administrators do now?

Check the vendor site for firmware updates, restrict access to the management interface to trusted networks, and review logs for unusual requests to cstecgi.cgi.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.