CVE-2026-6139
Published: 13 April 2026
Summary
CVE-2026-6139 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the UploadOpenVpnCert function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the FileName argument enables operating system command injection. The issue is tracked under CVE-2026-6139 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors with no required authentication or user interaction.
Remote, unauthenticated attackers can supply a crafted FileName value to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, consistent with the CWE-77 and CWE-78 classifications for command injection flaws. The exploit code has already been made public.
Public references include a detailed disclosure on GitHub, multiple Vuldb entries, and the vendor website, yet none of the provided sources describe available patches, firmware updates, or specific mitigation steps. The associated EPSS score remains low, with a current value of 0.0122 and a peak of only 0.0125, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21764
Vulnerability details
A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-6139 is a command injection vulnerability in a public-facing router web CGI interface (T1190: Exploit Public-Facing Application), enabling remote unauthenticated arbitrary OS command execution on the underlying Unix/Linux system (T1059.004: Unix Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the FileName argument in UploadOpenVpnCert to reject command-injection payloads before they reach the OS.
Enforces access-control policy on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote callers cannot invoke the vulnerable function.
Boundary-protection mechanisms can restrict or deny external network traffic to the router's management CGI interface, limiting exposure of the injection flaw.