CVE-2026-6131
Published: 12 April 2026
Summary
CVE-2026-6131 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability was found in the Totolink A7100RU router running firmware 7.4cu.2313_b20191024. It resides in the setTracerouteCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component. Manipulation of the command argument allows OS command injection, classified under CWE-77 and CWE-78, with a CVSS 4.0 score of 8.9 reflecting network attack vector, low complexity, and no required privileges or user interaction.
Remote unauthenticated attackers can send crafted requests to the CGI endpoint to execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router, and a public exploit has already been released.
The provided references point to a detailed proof-of-concept on GitHub along with VulDB entries and the vendor site, but contain no specific statements on patches, firmware updates, or other mitigations. The associated EPSS score has remained low and essentially flat at approximately 0.012, indicating no material increase in observed exploitation interest since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21748
Vulnerability details
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be…
more
launched remotely. The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing web CGI interface directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix Shell execution (T1059.004) on the router.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the untrusted 'command' argument passed to setTracerouteCfg, blocking the OS command injection vector.
Enforces authentication and authorization checks on the /cgi-bin/cstecgi.cgi endpoint so unauthenticated remote attackers cannot reach the vulnerable function.
Restricts remote network access to the router's management CGI interface, reducing the attack surface for the publicly exploitable command injection.