CVE-2026-6195
Published: 13 April 2026
Summary
CVE-2026-6195 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A security vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setPasswordCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the admpass argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors that require no authentication or user interaction.
Remote, unauthenticated attackers can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over the router, allowing modification of configuration, data exfiltration, or denial-of-service actions. Publicly available exploit code has been disclosed, although the current EPSS score remains low at 0.0123 with a peak of only 0.0125.
The vendor Totolink has been notified via its support site, and technical details along with proof-of-concept references are hosted on VulDB and GitHub. No information on official patches or specific mitigation steps is provided in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22036
Vulnerability details
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. The attack…
more
can be executed remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1059.004 (Unix Shell) for arbitrary command execution on the Linux-based router firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the admpass argument in setPasswordCfg to block OS command injection payloads.
Enforces authentication and authorization checks before permitting any access to the password configuration CGI function.
Limits privileges of the CGI handler process so that even a successful injection cannot execute arbitrary OS commands with full device control.