CVE-2026-6028
Published: 10 April 2026
Summary
CVE-2026-6028 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A security vulnerability has been detected in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setPptpServerCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the enable argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack conditions with no required authentication or user interaction.
An unauthenticated remote attacker can supply a crafted enable parameter to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, enabling outcomes such as configuration changes, traffic interception, or persistence mechanisms.
Public exploit code has been released, and the EPSS score rose from a low baseline of 0.0032 to a peak of 0.0125, indicating that exploitation interest emerged after disclosure and that the CVE warrants renewed attention. No vendor advisory or patch details are provided in the referenced sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21322
Vulnerability details
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable leads to os command injection. The attack may be initiated…
more
remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated OS command injection in a public-facing CGI interface on a router, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution on the likely Linux-based device OS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'enable' argument in setPptpServerCfg to block OS command injection via the CGI endpoint.
Enforces access control policy requiring authentication before any invocation of the unauthenticated /cgi-bin/cstecgi.cgi handler.
Restricts the router to least functionality by disabling or removing the vulnerable PPTP server configuration CGI when not required.