CVE-2026-6114
Published: 12 April 2026
Summary
CVE-2026-6114 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability identified as CVE-2026-6114 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setNetworkCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the proto argument enables operating system command injection, corresponding to CWE-77 and CWE-78. The issue received a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors without required authentication or user interaction.
Remote, unauthenticated attackers can supply crafted input to the proto parameter and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router, with the public exploit code now available for use.
The associated EPSS score remains low at 0.0122 with a peak of 0.0125, indicating limited observed exploitation interest to date. Vendor and vulnerability tracking references point to the Totolink site and detailed reports for further assessment, though no specific patch or mitigation guidance is detailed in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21705
Vulnerability details
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setNetworkCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument proto results in os command injection. The attack may…
more
be initiated remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-6114 is a command injection vulnerability in a public-facing router web interface (T1190), enabling remote unauthenticated arbitrary OS command execution on the network device (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the unsanitized proto argument supplied to setNetworkCfg that enables OS command injection.
Enforces authorization checks on the /cgi-bin/cstecgi.cgi endpoint so unauthenticated remote callers cannot reach the vulnerable function.
Limits privileges of the CGI process so that even a successful command injection yields minimal device control.