CVE-2026-6139: Totolink A7100RU OS Command Injection in UploadOpenVpnCert
A command injection flaw in the UploadOpenVpnCert function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024, allows a manipulated FileName argument to run operating system commands remotely. The CNA VulDB rates it critical with a CVSS 3.1 base score of 9.8, and the record states the exploit has been publicly disclosed. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-6139 affects the UploadOpenVpnCert function reached through /cgi-bin/cstecgi.cgi in the CGI Handler of the Totolink A7100RU, version 7.4cu.2313_b20191024. According to the record, manipulating the FileName argument leads to operating system command injection (CWE-77). The CNA is VulDB, and details are also listed in the VulDB entry 357003.
Impact
- The CVSS 3.1 vector published by the CNA is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network attack, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
- Successful command injection on a router would generally allow commands to run in the device context. The exact reach depends on device configuration, which the sources do not detail.
Affected products and versions
- Product named in the record: Totolink A7100RU, version 7.4cu.2313_b20191024.
- The structured affected list in the record is empty, so other versions or firmware builds cannot be confirmed from it.
- Vendor information is available at Totolink.
Exploitation status
- The record states that the exploit has been disclosed to the public and may be used.
- CISA KEV does not list this CVE, so no active exploitation is reported in the KEV catalog.
- No confirmed exploitation in the wild appears in the sources consulted.
- The record gives an EPSS probability of 0.03253 with a percentile of 0.88053.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean none exists, so check the vendor and the VulDB advisory for updates.
- Until an update is verified, restrict access to the router administration interface to trusted networks, disable remote management where it is not needed, and avoid exposing the device directly to the internet.
- Isolate or replace devices that cannot be updated, especially those running the listed build.
Detection guidance
- Review web management and CGI access logs for unexpected requests to the cstecgi.cgi endpoint, especially from unknown sources.
- Monitor devices for unexpected configuration changes, unfamiliar files, or outbound connections originating from the router.
- Review the GitHub README referenced in the record, and validate any indicators independently before relying on them.
Limitations of the available information
- The record has no title from the source, no affected version range beyond the single build, and no fixed version.
- Patch availability, vendor response, and whether other firmware builds are affected are unknown from the sources consulted.
- The record contains only CNA-provided CVSS scores, and no separate assessment is included.
- The VulDB CTI page is referenced, but its content was not provided in the record.
Frequently asked questions
Is CVE-2026-6139 being actively exploited?
CISA KEV does not list this CVE, so it is not reported as actively exploited there. The record says the exploit has been publicly disclosed, but no confirmed exploitation in the wild appears in the sources consulted.
Which Totolink device and version are affected?
The record names the Totolink A7100RU, version 7.4cu.2313_b20191024. The structured affected list is empty, so other versions cannot be confirmed from the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.