CVE-2026-6155
Published: 13 April 2026
Summary
CVE-2026-6155 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
A weakness has been identified in the Totolink A7100RU router running firmware 7.4cu.2313, specifically within the setWanCfg function of the /cgi-bin/cstecgi.cgi file in the CGI Handler component. Manipulation of the pppoeServiceName argument allows an attacker to inject operating system commands, corresponding to CWE-77 and CWE-78. The issue is remotely exploitable without authentication or user interaction, as reflected in its CVSS 4.0 score of 8.9.
An unauthenticated remote attacker can supply a crafted pppoeServiceName value to the WAN configuration endpoint and execute arbitrary commands on the underlying operating system, potentially leading to full device compromise including configuration changes, data exfiltration, or use as a pivot point. Public exploit code has been released, enabling straightforward reproduction of the attack.
The listed references include a detailed disclosure on Vuldb, a GitHub repository containing proof-of-concept material, and the vendor website, but contain no information on patches, firmware updates, or other mitigations. The associated EPSS score has remained low and essentially flat, moving only from 0.0122 to a peak of 0.0125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21810
Vulnerability details
A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack…
more
may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in a public-facing CGI endpoint on a router, enabling unauthenticated remote exploitation for arbitrary Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the pppoeServiceName input argument to the setWanCfg CGI function, blocking OS command injection.
Enforces boundary protection and interface restrictions that would deny unauthenticated remote access to the vulnerable /cgi-bin/cstecgi.cgi endpoint.
Limits privileges of the CGI handler process so that successful command injection cannot achieve full device compromise or lateral movement.