Which versions of Totolink A7100RU are affected by CVE-2026-6025?

Totolik A7100RU routers running version 7.4cu.2313_b20191024 contain a critical remote command injection vulnerability allowing unauthenticated attackers to completely compromise affected devices…

Is there a public PoC exploit available for CVE-2026-6025?

Yes, a public proof-of-concept exploit is available for CVE-2026-6025. Prioritise patching immediately. EPSS: 0.9%.

Totolink A7100RU CVE-2026-6025

Q: What is the CVSS score of CVE-2026-6025?

CVE-2026-6025 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21314 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-7796-2cv5-g5f4

Command Injection

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 05:45 euvd

EUVD-2026-21314

Analysis Generated

Apr 10, 2026 - 05:45 vuln.today

CVE Published

Apr 10, 2026 - 05:30 nvd

HIGH 8.9

DescriptionNVD

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. …

RemediationAI

Within 24 hours: Identify all Totolik A7100RU devices on corporate networks and VPNs using network discovery tools; document current firmware versions. Within 7 days: Contact affected users and isolate vulnerable routers from production networks; contact Totolik support for patch availability timeline and interim guidance. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-6025 vulnerability details – vuln.today

Back

Totolink A7100RU CVE-2026-6025

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

Totolink A7100RU CVE-2026-6025

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code