CVE-2026-6195: Totolink A7100RU command injection via admpass in setPasswordCfg
CVE-2026-6195 is a critical command injection weakness (CWE-77) reported in the setPasswordCfg function of the CGI handler on the Totolink A7100RU, version 7.4cu.2313_b20191024. The CNA rates it CVSS 3.1 9.8 and states that the attack can be carried out remotely and that a public exploit has been disclosed. The record does not list affected or fixed versions, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
CVE-2026-6195 is a command injection weakness (CWE-77) reported in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi handler on the Totolink A7100RU, version 7.4cu.2313_b20191024. According to the record, manipulating the admpass argument can lead to operating system command injection, and the attack can be carried out remotely.
Impact
The CNA-provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical). Under that vector, no privileges or user interaction are required, and the impact on confidentiality, integrity and availability is rated high. The CNA also lists CVSS 4.0 (8.9) and CVSS 2.0 (10) scores.
Affected products and versions
- Product named in the record: Totolink A7100RU, version 7.4cu.2313_b20191024.
- The record's affected and fixes lists are empty, so the full range of affected versions and any fixed build are unknown from the available data.
- The vendor website listed in the references is https://www.totolink.net/. It was not possible to confirm advisory content for this CVE from the record.
Exploitation status
The record marks this CVE as not listed in the CISA KEV catalog, so active exploitation is not recorded there. The description states that the exploit has been publicly disclosed and may be used. EPSS is 0.03253 with a percentile of 0.88055, as given in the record. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Check with Totolink for firmware updates for the A7100RU line and apply any vendor-issued fix.
- Do not expose the device web management interface to the internet. Limit it to trusted management networks and disable remote administration where it is not required.
- Replace default or weak administrative credentials and review recent configuration changes.
- If no fix is available, consider isolating the device or replacing it, since the record gives no fixed version.
Detection guidance
- Review web management logs for unusual requests to the cstecgi.cgi endpoint, especially requests from unexpected sources.
- Monitor for unexpected configuration changes, new administrative accounts, or device behavior suggesting command execution.
- Watch outbound traffic from the device for connections it does not normally make.
Limitations of the available information
The record has no CNA-supplied title, no affected or fixed version data, and no vendor advisory. The EPSS date (2026-10-13) is later than the publication date (2026-04-13), so it should be verified against the source. Severity and scores come from the CNA and were not independently verified here.
Frequently asked questions
Is CVE-2026-6195 being actively exploited?
The record lists the CVE as not included in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The description does state that a public exploit has been disclosed and may be used.
Which Totolink versions are affected?
The record names the Totolink A7100RU version 7.4cu.2313_b20191024, but its affected version list is empty. The full range of affected versions is unknown from the available data.
Is there a fixed version?
The record does not list any fixed version. A missing fixed version does not mean no fix exists, so checking with the vendor is recommended.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.