CVE-2026-6138
Published: 13 April 2026
Summary
CVE-2026-6138 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A flaw has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the mac argument enables operating system command injection. The vulnerability is tracked under CVE-2026-6138, carries a CVSS 4.0 score of 8.9, and is associated with CWE-77 and CWE-78.
Remote attackers can exploit the flaw without authentication or user interaction by sending crafted requests to the affected CGI endpoint. Successful exploitation grants the ability to execute arbitrary operating system commands, resulting in full compromise of confidentiality, integrity, and availability on the device.
Public references include a detailed proof-of-concept on GitHub along with entries on VulDB that confirm the exploit has been published and is usable. No vendor advisory or patch information is provided in the available references, though the manufacturer site is listed. The EPSS score remains low at 0.0122 with a peak of 0.0125, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21761
Vulnerability details
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated…
more
remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing router CGI enables remote exploitation of public-facing application (T1190) and facilitates arbitrary OS command execution on network device (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the untrusted 'mac' argument passed to setAccessDeviceCfg, blocking the OS command injection vector at the CGI handler.
Enforces access-control decisions on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote requests cannot invoke setAccessDeviceCfg at all.
Boundary-protection mechanisms can restrict or deny external traffic to the router's management CGI interface, limiting remote unauthenticated reachability.