Which versions of A7100Ru are affected by CVE-2026-6027?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution through a critical OS injection flaw, allowing attackers to completely…

Is there a public PoC exploit available for CVE-2026-6027?

Yes, a public proof-of-concept exploit is available for CVE-2026-6027. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6027?

Within 24 hours: Identify all Totolik A7100RU devices in inventory and isolate affected units from production networks if running firmware 7.4cu.2313_b20191024 or earlier; document current firmware versions across the deployment. Within 7 days: Contact Totolik support to confirm patch availability timeline and escalate if unavailable; evaluate replacement hardware from vendors with active security support. Within 30 days: If no patch emerges, implement compensating network controls (segment routers on isolated VLAN, restrict inbound internet access, deploy intrusion detection signatures for CVE-2026-6027 exploitation attempts); replace devices with supported alternatives if patch timeline exceeds 90 days.

A7100Ru CVE-2026-6027

Q: What is the CVSS score of CVE-2026-6027?

CVE-2026-6027 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21319 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-w3qf-xc88-m8c9

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 06:15 euvd

EUVD-2026-21319

Analysis Generated

Apr 10, 2026 - 06:15 vuln.today

CVE Published

Apr 10, 2026 - 06:00 nvd

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction, granting complete device compromise with potential for lateral network movement. Publicly available exploit code exists (GitHub POC). CVSS 9.8 severity reflects network-accessible attack vector with no privilege requirements.

Technical ContextAI

CWE-78 vulnerability stems from insufficient input sanitization in CGI handler's setUrlFilterRules function. The 'enable' parameter undergoes no validation before shell command execution, allowing injection of arbitrary OS commands through metacharacter manipulation. Network-accessible attack surface (AV:N) and absence of authentication barriers (PR:N) enable trivial exploitation via crafted HTTP requests to the CGI endpoint.

RemediationAI

No vendor-released patch identified at time of analysis. Check Totolink official site (https://www.totolink.net/) for firmware updates addressing CVE-2026-6027. Until patched firmware is available, implement network segmentation to isolate vulnerable devices from untrusted networks, disable remote administration interfaces, restrict CGI endpoint access via firewall rules permitting only trusted management IPs, and monitor for abnormal outbound connections or command execution patterns. Organizations unable to apply immediate mitigations should consider device replacement with actively maintained alternatives. VulDB advisory: https://vuldb.com/vuln/356603. Technical analysis and POC: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_172/README.md.