Cyber Resilience

CVE-2026-6116

HighRCE

Published: 12 April 2026

Published
12 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0180 75.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-6116 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).

Deeper analysis

A vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the ip argument enables OS command injection, corresponding to CWE-77 and CWE-78.

The flaw can be exploited remotely by unauthenticated attackers over the network, granting them the ability to execute arbitrary operating system commands on the affected device with high impact to confidentiality, integrity, and availability.

Public references include a detailed disclosure on GitHub along with entries in VulDB, but no specific mitigation guidance or patch information is provided in the available sources. The exploit code has already been made public.

The associated EPSS score remains low, moving only from 0.0122 to a peak of 0.0125 with no material increase after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument ip leads to os command injection. Remote exploitation of the attack…

more

is possible. The exploit has been disclosed to the public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Unauthenticated OS command injection via web CGI interface on public-facing router enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-2152Shared CWE-77, CWE-78
CVE-2026-5677Shared CWE-77, CWE-78
CVE-2026-2157Shared CWE-77, CWE-78
CVE-2026-7136Shared CWE-77, CWE-78
CVE-2026-7121Shared CWE-77, CWE-78
CVE-2026-9387Shared CWE-77, CWE-78
CVE-2026-9477Shared CWE-77, CWE-78
CVE-2026-2063Shared CWE-77, CWE-78
CVE-2026-2847Shared CWE-77, CWE-78

Affected Assets

Totolink
A7100RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the untrusted 'ip' argument passed to setDiagnosisCfg, blocking the OS command injection vector.

prevent

Enforces boundary protection and interface restrictions that can deny unauthenticated network access to the vulnerable /cgi-bin/cstecgi.cgi endpoint.

prevent

Requires disabling or restricting non-essential functions such as the diagnosis configuration handler that contains the injectable code path.

References