CVE-2026-6132
Published: 12 April 2026
Summary
CVE-2026-6132 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SC-7 (Boundary Protection).
Deeper analysis
A vulnerability was identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setLedCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the enable argument permits OS command injection, corresponding to CWE-77 and CWE-78.
Remote attackers can exploit the flaw without authentication or user interaction by sending crafted requests to the affected CGI endpoint. Successful exploitation grants the ability to execute arbitrary operating system commands, resulting in high impact to confidentiality, integrity, and availability as reflected in the CVSS 8.9 rating.
The exploit has been publicly disclosed, with references including detailed reports on Vuldb and a GitHub repository containing reproduction information, alongside the vendor site. No specific patch or mitigation guidance is detailed in the available references.
The EPSS score rose from a low starting point to a peak of 0.0125, indicating that exploitation interest emerged after disclosure and that the CVE warrants renewed attention.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21749
Vulnerability details
A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack…
more
is possible. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing CGI interface on router directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059.008 (Network Device CLI) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the 'enable' argument in setLedCfg before it reaches the OS command interpreter, blocking the CWE-78 injection.
Enforces boundary protection (e.g., ACLs or firewall rules) that can deny unauthenticated remote access to /cgi-bin/cstecgi.cgi, reducing the attack surface.
Requires timely application of vendor patches or firmware updates that eliminate the vulnerable setLedCfg implementation.