Cyber Posture

CVE-2026-6131

CriticalRCEUpdated

Published: 12 April 2026

Published
12 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0122 79.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6131 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-8 (Identification and Authentication (Non-organizational Users)) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents OS command injection by validating and sanitizing the untrusted 'command' argument in the setTracerouteCfg CGI function.

prevent

Remediates the specific command injection flaw in the Totolink A7100RU firmware through identification, reporting, and correction.

prevent

Blocks unauthenticated remote attackers from accessing and exploiting the vulnerable CGI handler endpoint.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Unauthenticated remote OS command injection via public-facing web CGI interface directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix Shell execution (T1059.004) on the router.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be…

more

launched remotely. The exploit has been made public and could be used.

Deeper analysisAI

CVE-2026-6131 is an OS command injection vulnerability affecting the Totolink A7100RU router on firmware version 7.4cu.2313_b20191024. The flaw resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the "command" argument enables arbitrary OS command execution. Published on 2026-04-12, it is classified under CWE-77 (Command Injection) and CWE-78 (OS Command Injection).

The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Any unauthenticated remote attacker can exploit it over the network with low complexity and no user interaction required, potentially achieving high impacts on confidentiality, integrity, and availability, such as full device compromise, data exfiltration, persistent access, or service disruption.

Advisories referenced in VulDB entries (vuln/356995 and related pages) document the issue, while a GitHub repository provides a public exploit at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_182/README.md. The Totolink vendor site (https://www.totolink.net/) is listed, but no specific patches or mitigations are detailed in the available information.

The exploit has been publicly disclosed and could be used by attackers targeting exposed Totolink A7100RU devices.

Details

CWE(s)

Affected Products

Totolink
A7100RU
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2025-9387Shared CWE-77, CWE-78
CVE-2026-6112Shared CWE-77, CWE-78
CVE-2026-8191Shared CWE-77, CWE-78
CVE-2026-7121Shared CWE-77, CWE-78
CVE-2025-1608Shared CWE-77, CWE-78
CVE-2026-27811Shared CWE-77, CWE-78
CVE-2025-2094Shared CWE-77, CWE-78
CVE-2025-15500Shared CWE-77, CWE-78
CVE-2026-7204Shared CWE-77, CWE-78
CVE-2026-6026Shared CWE-77, CWE-78

References