CVE-2026-6154: Totolink A7100RU OS Command Injection in setWizardCfg

Overview

The record describes a command injection flaw (CWE-77) in the setWizardCfg function of the /cgi-bin/cstecgi.cgi file, part of the CGI Handler component of the Totolink A7100RU, firmware 7.4cu.2313_b20191024. Manipulating the wizard argument is reported to lead to execution of operating system commands. The entry was published by VulDB as a CNA on 2026-04-13 and its status is Deferred in the record. See the VulDB entry and the CVE record.

Impact

• The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack vector, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability.
• The record scores it 9.8 under CVSS 3.1, 8.9 under CVSS 4.0 and 10 under CVSS 2.0, all provided by the CNA.
• Because the flaw is described as command injection, a successful attack would run commands with the privileges of the vulnerable service on the device. The exact privilege level is unknown from the record.

Affected products and versions

The only affected version named in the record is Totolink A7100RU 7.4cu.2313_b20191024. The structured affected list in the record is empty, so other versions or hardware revisions cannot be confirmed from the sources provided. Vendor information is available at Totolink.

Exploitation status

The record states that the exploit has been released to the public and may be used for attacks. The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation in the wild is shown by the sources consulted. The EPSS value in the record is 0.03253 (percentile 0.88054), dated 2026-10-13, which estimates the likelihood of exploitation activity and should be read with its date in mind.

Remediation and mitigation

• The record lists no fixed version and no patch. Check the Totolink site and your vendor or support channel for firmware updates for the A7100RU.
• If no update is available, reduce exposure: remove the management interface from internet-facing access, restrict access to trusted administrative networks, and disable remote administration where it is not required.
• Place affected devices behind network segmentation so that a compromised router cannot reach sensitive internal systems.
• If the device model is no longer supported or no fix is published, plan replacement with supported hardware.

Detection guidance

• Review web server and device logs for unexpected requests to the cstecgi.cgi handler, especially from unfamiliar sources or at unusual times.
• Watch for unexpected outbound connections or configuration changes originating from the router, which may indicate post-compromise activity.
• Monitor for changes to device settings, administrative accounts and firmware versions.

Limitations of the available information

The record gives no fixed version, no complete list of affected versions, no vendor advisory and no detailed technical root-cause analysis. The exploit's existence is stated in the description but its content is not analysed here. The record lists a third-party repository, but its contents were not reviewed for this analysis. Severity values come from the CNA and may change as further information becomes available.

Frequently asked questions

Is CVE-2026-6154 being actively exploited?

The record says a public exploit has been released, but this CVE is not listed in CISA KEV and the sources consulted do not confirm active exploitation in the wild.

Which devices are affected?

The record names the Totolink A7100RU with firmware 7.4cu.2313_b20191024. The structured affected list is empty, so other versions cannot be confirmed.

Is there a fix?

The record lists no fixed version. Check the vendor site and support channels for firmware updates, and reduce exposure in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.