CVE-2026-6155: Totolink A7100RU OS Command Injection via setWanCfg pppoeServiceName
CVE-2026-6155 describes an OS command injection weakness (CWE-77) in the setWanCfg function of the CGI Handler on Totolink A7100RU 7.4cu.2313, triggered through the pppoeServiceName argument. The CNA scores it 9.8 (critical) under CVSS 3.1 and reports that the attack can be launched remotely. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and no confirmed in-the-wild exploitation appears in the sources consulted.
Overview
CVE-2026-6155 was published on 2026-04-13 and concerns the Totolink A7100RU, version 7.4cu.2313. According to the record, the flaw is in the setWanCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component. The manipulated argument is pppoeServiceName, and the weakness is classified as CWE-77 (Command Injection).
Impact
- The record states that manipulation of pppoeServiceName can lead to operating system command injection.
- The CNA rates the CVE as critical, with a CVSS 3.1 base score of 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact if exploited.
- The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
- The record says the attack may be launched remotely.
Affected products and versions
- Product: Totolink A7100RU.
- Version identified in the description: 7.4cu.2313.
- The structured affected-product list in the record is empty, so other affected versions cannot be determined from the available data.
Exploitation status
- The record states that an exploit has been made publicly available and could be used for attacks.
- The CVE is not listed in CISA KEV (kev.listed is false).
- No confirmed active exploitation or exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- No fixed version is listed in the record. This does not mean no fix exists; the absence is unknown information.
- Check the vendor site for firmware updates and advisories: Totolink.
- Until a vendor fix is confirmed, limit exposure of the device management interface, avoid exposing it to the internet, and place it behind network segmentation or a filtering gateway.
- Inventory Totolink A7100RU devices and prioritize those running 7.4cu.2313 or similar firmware branches that cannot be verified as patched.
- Consider replacing unsupported devices if no vendor fix becomes available.
Detection guidance
- Monitor logs and traffic to the device's CGI interface for unexpected requests to cstecgi.cgi, especially those affecting WAN or PPPoE configuration.
- Watch for unexpected configuration changes, unfamiliar processes, or outbound connections originating from the device.
- Review the vulnerability records at VulDB and the GitHub advisory repository for updates to the detection picture.
Limitations of the available information
- The structured affected-version and fixed-version fields are empty in the record.
- The CVE was in Deferred status at the time of the record.
- Exploit details, proof-of-concept availability beyond the statement in the record, and vendor confirmation are not provided in the data used here.
- EPSS data is present (probability 0.03253, percentile 0.88057), but its date field is not reliable for interpretation and is not used as a basis for conclusions.
Frequently asked questions
What is CVE-2026-6155?
It is a command injection weakness (CWE-77) in the setWanCfg function of the Totolink A7100RU 7.4cu.2313 CGI Handler, triggered through the pppoeServiceName argument.
Is CVE-2026-6155 being actively exploited?
The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.