Which versions of A7100Ru are affected by CVE-2026-6025?

Totolik A7100RU routers running version 7.4cu.2313_b20191024 contain a critical remote command injection vulnerability allowing unauthenticated attackers to completely compromise affected devices…

Is there a public PoC exploit available for CVE-2026-6025?

Yes, a public proof-of-concept exploit is available for CVE-2026-6025. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6025?

Within 24 hours: Identify all Totolik A7100RU devices on corporate networks and VPNs using network discovery tools; document current firmware versions. Within 7 days: Contact affected users and isolate vulnerable routers from production networks; contact Totolik support for patch availability timeline and interim guidance. Within 30 days: Replace vulnerable A7100RU units with patched-firmware alternatives or alternative routers from vendors with confirmed patch availability; implement network segmentation to restrict router administrative access.

A7100Ru CVE-2026-6025

Q: What is the CVSS score of CVE-2026-6025?

CVE-2026-6025 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21314 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-7796-2cv5-g5f4

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 05:45 euvd

EUVD-2026-21314

Analysis Generated

Apr 10, 2026 - 05:45 vuln.today

CVE Published

Apr 10, 2026 - 05:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. CVSS 9.8 critical severity reflects network accessibility, no complexity barriers, and complete confidentiality/integrity/availability impact. Publicly available exploit code exists, significantly lowering attack barrier for opportunistic scanning campaigns targeting consumer routers.

Technical ContextAI

CWE-78 OS command injection in CGI handler due to insufficient input sanitization of the 'enable' parameter in setSyslogCfg function. CVSS vector PR:N confirms unauthenticated remote exploitation. Vulnerable embedded web server directly passes attacker-controlled input to system shell execution context.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing this vulnerability per manufacturer site review (https://www.totolink.net/). Immediate mitigations: disable remote administration interfaces, restrict CGI access to trusted internal networks via firewall rules, implement network segmentation to isolate IoT devices. Monitor vendor security bulletins at https://www.totolink.net/ for future firmware updates. Consider replacement with actively maintained router models if vendor remains unresponsive. Detailed exploit analysis available at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_170/README.md and VulDB tracking at https://vuldb.com/vuln/356601.