CVE-2026-6029
Published: 10 April 2026
Summary
CVE-2026-6029 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setVpnAccountCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the User argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors that require no authentication or user interaction.
An unauthenticated remote attacker can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over the router, potentially allowing persistent access, traffic interception, or use of the device in further attacks. A public exploit for this vulnerability has been released.
The EPSS score for CVE-2026-6029 has risen from a low baseline to a recorded peak of 0.0125, indicating emerging exploitation interest after disclosure that warrants renewed attention from defenders. No vendor advisory or patch details are provided in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21324
Vulnerability details
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched…
more
remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (T1190) via unauthenticated remote OS command injection in router CGI, directly facilitating Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the User argument in setVpnAccountCfg to block OS command injection via the CGI endpoint.
Enforces access restrictions on the unauthenticated /cgi-bin/cstecgi.cgi endpoint so that only authorized subjects can invoke setVpnAccountCfg.
Boundary-protection mechanisms can restrict or filter network traffic to the vulnerable CGI handler before malicious input reaches the device.