CVE-2026-6140: Totolink A7100RU OS Command Injection via UploadFirmwareFile FileName Parameter

Overview

CVE-2026-6140 is a command injection weakness (CWE-77) reported in the UploadFirmwareFile function, reached through /cgi-bin/cstecgi.cgi, of the CGI Handler component of Totolink A7100RU 7.4cu.2313_b20191024. According to the record, manipulating the FileName argument results in operating system command injection, and the attack may be initiated remotely. The CNA is VulDB, and the source status is recorded as Deferred.

Impact

• The CNA-provided CVSS 3.1 base score is 9.8 (critical), with high confidentiality, integrity and availability impact stated in the vector.
• Command injection on a network device can allow an attacker to run operating system commands with the privileges of the vulnerable service. The record does not specify those privileges.
• The full scope of impact on the device and connected networks is unknown from the available information.

Affected products and versions

The record names only Totolink A7100RU 7.4cu.2313_b20191024 as the affected product and version. The structured affected and fixes lists in the record are empty, so no fixed version is known from the available data. A missing fixed version does not mean no fix exists.

Exploitation status

The record states that the exploit has been made public and could be used. The CISA KEV entry is not listed, so the record does not confirm active exploitation. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

• Identify whether any A7100RU devices are in use, including those managed by third parties, and confirm their firmware version.
• Because no fixed version is listed in the record, check the vendor site Totolink for firmware updates and follow vendor guidance.
• Do not expose the device management interface to the internet. Restrict access to trusted administrative networks.
• If no update is available, plan replacement or decommissioning of the device, since public exploit availability raises the risk of opportunistic attacks.

Detection guidance

• Review web server and CGI access logs for requests to /cgi-bin/cstecgi.cgi, especially those involving firmware upload functions, and investigate unexpected or unusual parameter values.
• Monitor the device for unexpected outbound connections, new processes or configuration changes.
• Apply network monitoring at the perimeter for traffic to management interfaces from untrusted sources.

Limitations of the available information

• The record does not include a vendor advisory confirming the flaw or a fixed firmware version.
• The record does not describe the privileges under which injected commands would run.
• The EPSS values are as recorded, with the date 2026-10-13 shown in the record, and should be interpreted with that in mind.
• The sources consulted do not confirm exploitation in the wild.

Frequently asked questions

Is CVE-2026-6140 being actively exploited?

CISA KEV does not list this CVE, so the record does not confirm active exploitation. The record does state that a public exploit has been made public, and no confirmed exploitation in the wild appears in the sources consulted.

Which device is affected by CVE-2026-6140?

The record names Totolink A7100RU 7.4cu.2313_b20191024 and the UploadFirmwareFile function in the CGI Handler component. The structured affected list is empty, so other versions cannot be confirmed from the record.

Is there a fixed firmware version?

The record does not list a fixed version. This is unknown from the available data, so check the vendor site for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.