CVE-2026-6113
Published: 12 April 2026
Summary
CVE-2026-6113 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A security vulnerability identified as CVE-2026-6113 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setTtyServiceCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the ttyEnable argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors that require no authentication or user interaction.
Remote, unauthenticated attackers can supply crafted input to the vulnerable CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router, with a publicly disclosed proof-of-concept exploit available that lowers the barrier for potential misuse.
The EPSS score remains low, moving only from 0.0122 currently to a peak of 0.0125, indicating limited observed exploitation interest to date. No vendor advisory or patch information is detailed in the available references, which primarily point to disclosure repositories and the Totolink support site.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21702
Vulnerability details
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTtyServiceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument ttyEnable leads to os command injection. The attack…
more
can be launched remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing CGI endpoint on router enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the ttyEnable argument in setTtyServiceCfg before it is passed to the OS, blocking command injection at the root cause.
Enforces authentication and authorization checks on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote callers cannot reach the vulnerable function.
Applies boundary protections (e.g., ACLs or WAF rules) that restrict external network access to the router's management CGI interface, limiting remote unauthenticated exploitation.