Which versions of A7100Ru are affected by CVE-2026-6026?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 and earlier contain a critical unauthenticated remote command injection vulnerability that allows attackers to gain complete system…

Is there a public PoC exploit available for CVE-2026-6026?

Yes, a public proof-of-concept exploit is available for CVE-2026-6026. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6026?

Within 24 hours: Inventory all Totolik A7100RU deployments and identify current firmware versions. Within 7 days: Contact Totolik support to determine patch availability timeline; if no patch is imminent, isolate affected routers from production networks or replace with alternative hardware. Within 30 days: Once patches are released, deploy them immediately to all A7100RU units, or complete replacement with devices from vendors with active security support.

A7100Ru CVE-2026-6026

Q: What is the CVSS score of CVE-2026-6026?

CVE-2026-6026 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21318 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-wqxj-7q65-946x

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 06:15 euvd

EUVD-2026-21318

Analysis Generated

Apr 10, 2026 - 06:15 vuln.today

CVE Published

Apr 10, 2026 - 05:45 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setPortalConfWeChat of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument enable results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability resides in the setPortalConfWeChat function within /cgi-bin/cstecgi.cgi, exploitable by manipulating the 'enable' parameter. CVSS 9.8 severity reflects network-accessible attack vector requiring no authentication or user interaction, with full system compromise potential. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers targeting vulnerable router deployments.

Technical ContextAI

CWE-78 OS command injection in CGI handler due to insufficient input validation on 'enable' parameter in setPortalConfWeChat function. Attacker-controlled input passed to system shell without sanitization enables arbitrary command execution with router process privileges. Network accessibility (AV:N) combined with unauthenticated access (PR:N) creates critical attack surface in embedded device firmware.

RemediationAI

No vendor-released patch identified at time of analysis. Check Totolink official website (https://www.totolink.net/) for firmware updates addressing CVE-2026-6026. Until patched firmware becomes available, implement network-level mitigations: disable remote administration interfaces, restrict CGI endpoint access to trusted management networks only via firewall rules, and deploy intrusion prevention signatures targeting command injection patterns in setPortalConfWeChat requests. Consider replacing device if vendor abandons support. Monitor VulDB advisory for patch announcements: https://vuldb.com/vuln/356602. If device exposed to internet, immediately isolate from WAN or decommission until fix available due to publicly available exploit code and unauthenticated remote exploitation risk.