CVE-2026-6156
Published: 13 April 2026
Summary
CVE-2026-6156 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-17 (Remote Access).
Deeper analysis
A security vulnerability identified as CVE-2026-6156 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the Comment argument enables OS command injection, as classified under CWE-77 and CWE-78. The issue carries a CVSS 4.0 score of 8.9, reflecting high impact on confidentiality, integrity, and availability.
Remote attackers can exploit the flaw without authentication or user interaction by sending crafted requests that manipulate the Comment parameter, allowing arbitrary operating system command execution on the device. Publicly disclosed exploit details indicate that successful attacks could lead to full device compromise, including potential persistence or lateral movement within a network.
No vendor advisory or patch information is detailed in the available references, which include a GitHub disclosure repository, multiple Vuldb entries, and the Totolink vendor site. The EPSS score remains low and stable at approximately 0.0122 currently with a peak of 0.0125, and no confirmed real-world exploitation has been reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21812
Vulnerability details
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument Comment leads to os command injection. Remote exploitation of the attack…
more
is possible. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing router web CGI interface (T1190), directly enabling arbitrary command execution on the network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the Comment argument in setIpQosRules to block OS command injection via CWE-77/78.
Boundary protection can restrict or deny unauthenticated remote access to /cgi-bin/cstecgi.cgi, limiting exposure of the vulnerable CGI handler.
Enforces authentication, authorization, and encryption requirements for all remote management sessions to the router's web interface.