Cyber Resilience

CVE-2026-6154

HighRCE

Published: 13 April 2026

Published
13 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0182 76.0th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-6154 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-6154 is an OS command injection vulnerability in the Totolink A7100RU router running firmware 7.4cu.2313_b20191024. The flaw resides in the setWizardCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component; unsanitized input supplied to the wizard argument is passed directly to the underlying operating system, enabling command execution. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9.

An unauthenticated attacker can exploit the vulnerability over the network by sending a crafted HTTP request to the affected CGI endpoint. Successful exploitation grants the attacker the ability to execute arbitrary operating-system commands, resulting in full compromise of the device’s confidentiality, integrity, and availability.

Public exploit code has been released, as referenced in the associated VulDB and GitHub entries, and the vendor’s site is listed among the disclosures. The EPSS score remains low, moving only from 0.0122 to a peak of 0.0125 with no material increase after publication.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack…

more

may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

The vulnerability is a remotely exploitable OS command injection in a public-facing CGI interface on a router, directly enabling T1190 (Exploit Public-Facing Application) for initial access and T1059.008 (Network Device CLI) for arbitrary command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7123Shared CWE-77, CWE-78
CVE-2026-6114Shared CWE-77, CWE-78
CVE-2026-2082Shared CWE-77, CWE-78
CVE-2026-5997Shared CWE-77, CWE-78
CVE-2025-15254Shared CWE-77, CWE-78
CVE-2025-1819Shared CWE-77, CWE-78
CVE-2026-7243Shared CWE-77, CWE-78
CVE-2026-1506Shared CWE-77, CWE-78
CVE-2026-3696Shared CWE-77, CWE-78
CVE-2026-4627Shared CWE-77, CWE-78

Affected Assets

Totolink
A7100RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the wizard argument before it reaches the OS, blocking the command-injection path in setWizardCfg.

prevent

Enforces access-control policy on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote requests cannot invoke setWizardCfg at all.

prevent

Boundary-protection mechanisms can restrict or deny external network access to the router's management CGI interface, limiting the attack surface.

References