CVE-2026-6115
Published: 12 April 2026
Summary
CVE-2026-6115 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A flaw has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setAppCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the enable argument permits OS command injection. The vulnerability is tracked as CVE-2026-6115 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible command injection weaknesses classified under CWE-77 and CWE-78.
Remote, unauthenticated attackers can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router without requiring user interaction or elevated privileges. Public exploit code has already been released.
The provided references consist of a detailed vulnerability disclosure on GitHub along with VulDB entries and the vendor site, but contain no specific patch or mitigation guidance. The EPSS score remains low, moving only from 0.0122 to a peak of 0.0125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21706
Vulnerability details
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack may be…
more
launched remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated remote exploitation of a public-facing web CGI application (T1190) to inject and execute arbitrary OS commands on the network device (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandatory validation and sanitization of the enable argument in setAppCfg would directly block the OS command injection payload before it reaches the shell.
Enforcing authenticated and authorized access to /cgi-bin/cstecgi.cgi would prevent unauthenticated remote attackers from reaching the vulnerable function.
Boundary filtering or application-layer inspection at network perimeters can drop requests containing command-injection metacharacters targeting the CGI endpoint.