CVE-2026-6140
Published: 13 April 2026
Summary
CVE-2026-6140 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-6140 is an OS command injection vulnerability in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where unsanitized input to the FileName argument allows arbitrary command execution. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9 reflecting network-accessible attack conditions without authentication or user interaction.
Remote, unauthenticated attackers can supply a malicious FileName value to the CGI endpoint and execute operating-system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected router, enabling outcomes such as configuration changes, malware deployment, or pivoting into attached networks. The vulnerability description states that a working exploit has already been published.
Public references include a detailed proof-of-concept on GitHub, multiple Vuldb entries, and the vendor site, yet none of the listed sources describe available patches, firmware updates, or specific mitigation steps. The EPSS score rose from a baseline of 0.0032 to a peak of 0.0125, indicating a measurable increase in observed exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21766
Vulnerability details
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument FileName results in os command injection. The attack may be initiated remotely.…
more
The exploit has been made public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing CGI web interface on a router (T1190), enabling arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the FileName argument in UploadFirmwareFile to block OS command injection via CWE-77/78.
Enforces access-control decisions on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote callers cannot invoke firmware-upload functions.
Requires identification and authentication before any user or process can reach the vulnerable CGI handler, eliminating the unauthenticated attack vector described in the CVE.