CVE Intelligence
Analysis AI-assisted

CVE-2026-6156: Totolink A7100RU OS Command Injection via setIpQosRules

A command injection flaw has been reported in the setIpQosRules function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024, triggered through the Comment argument. The CNA VulDB rates it critical with a CVSS 3.1 base score of 9.8 and states that remote exploitation is possible and that a public exploit exists. CISA KEV does not list it, and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

VulDB (as CNA) reports a command injection weakness (CWE-77) in the setIpQosRules function of the CGI Handler in the Totolink A7100RU, firmware 7.4cu.2313_b20191024. According to the record, manipulation of the Comment argument leads to operating system command injection. The record was published on 2026-04-13 with source status Deferred.

Impact

  • The record states that remote exploitation is possible.
  • A successful command injection would generally allow an attacker to run operating system commands on the affected device.
  • The CNA's CVSS 3.1 vector rates confidentiality, integrity and availability impact as high, with no privileges and no user interaction required.
  • The CNA-provided CVSS 3.1 base score is 9.8 (critical). Other CNA-provided scores are 8.9 under CVSS 4.0 and 10 under CVSS 2.0.

Affected products and versions

  • Product: Totolink A7100RU.
  • Version identified in the record: 7.4cu.2313_b20191024.
  • The record's affected list is empty, so no further version range is confirmed.
  • Vendor site: Totolink.

Exploitation status

The CNA states that the exploit has been publicly disclosed and may be used. CISA KEV does not list this CVE, and no confirmed active exploitation or exploitation in the wild appears in the sources consulted. The record gives an EPSS probability of 0.03253 (percentile 0.88057), dated 2026-10-13.

Remediation and mitigation

  • The record lists no fixed version. This does not mean no fix exists, so check with the vendor for firmware updates for the A7100RU.
  • Until an update is verified, restrict access to the device's web management interface, avoid exposing it to the internet, and keep it behind network controls.
  • Assess whether the device is still needed and whether it can be replaced or retired if no vendor fix is available.
  • Track the VulDB entry and the vendor site for updates.

Detection guidance

  • Monitor the device for unexpected outbound connections, configuration changes or new processes where logs are available.
  • Review access logs of the administrative interface for unusual requests.
  • Observe traffic to and from the device for anomalies at a general level.

Limitations of the available information

  • The record does not list affected firmware versions beyond the one named, nor any fixed versions.
  • The CNA vector indicates no privileges and no user interaction, but independent verification is not included in the record.
  • NVD analysis is not part of the supplied record.
  • Details of the publicly disclosed exploit are not reproduced here.

Frequently asked questions

Is this CVE being actively exploited?

CISA KEV does not list it, and the sources consulted do not confirm active exploitation. The CNA does state that a public exploit has been disclosed and may be used.

Is there a fix for this vulnerability?

The record lists no fixed version. That is unknown rather than proof that no fix exists, so check the vendor for firmware updates for the Totolink A7100RU.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.