CVE-2026-6116
Published: 12 April 2026
Summary
CVE-2026-6116 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
A vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the ip argument enables OS command injection, corresponding to CWE-77 and CWE-78.
The flaw can be exploited remotely by unauthenticated attackers over the network, granting them the ability to execute arbitrary operating system commands on the affected device with high impact to confidentiality, integrity, and availability.
Public references include a detailed disclosure on GitHub along with entries in VulDB, but no specific mitigation guidance or patch information is provided in the available sources. The exploit code has already been made public.
The associated EPSS score remains low, moving only from 0.0122 to a peak of 0.0125 with no material increase after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21708
Vulnerability details
A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument ip leads to os command injection. Remote exploitation of the attack…
more
is possible. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection via web CGI interface on public-facing router enables T1190 (Exploit Public-Facing Application) for initial access and T1059.004 (Unix Shell) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the untrusted 'ip' argument passed to setDiagnosisCfg, blocking the OS command injection vector.
Enforces boundary protection and interface restrictions that can deny unauthenticated network access to the vulnerable /cgi-bin/cstecgi.cgi endpoint.
Requires disabling or restricting non-essential functions such as the diagnosis configuration handler that contains the injectable code path.