Which versions of A7100Ru are affected by CVE-2026-6029?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical command injection vulnerability allowing unauthenticated attackers to remotely execute arbitrary system commands and…

Is there a public PoC exploit available for CVE-2026-6029?

Yes, a public proof-of-concept exploit is available for CVE-2026-6029. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6029?

Within 24 hours: Identify all Totolik A7100RU routers in your environment and isolate firmware version 7.4cu.2313_b20191024 devices from untrusted networks; check vendor (Totolik) security advisory for available firmware updates and apply immediately if released. Within 7 days: Complete inventory of all affected devices and verify firmware version across all instances; implement network segmentation to restrict access to router management interfaces to authorized administrative subnets only. Within 30 days: Replace affected routers if no patched firmware becomes available, or confirm successful upgrade to patched firmware version and validate through manufacturer advisory.

A7100Ru CVE-2026-6029

Q: What is the CVSS score of CVE-2026-6029?

CVE-2026-6029 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21324 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 07:00 euvd

EUVD-2026-21324

Analysis Generated

Apr 10, 2026 - 07:00 vuln.today

CVE Published

Apr 10, 2026 - 06:30 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. No authentication, low complexity, network-accessible attack vector enables full system compromise with high confidentiality, integrity, and availability impact.

Technical ContextAI

CWE-78 OS command injection vulnerability in CGI handler processes unsanitized User parameter input within setVpnAccountCfg function. Insufficient input validation permits shell metacharacter injection, enabling arbitrary command execution under CGI process privileges on embedded Linux router system.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-6029 on official channels (https://www.totolink.net/). Immediate mitigation: disable remote management interfaces, restrict CGI endpoint access via firewall rules permitting only trusted internal networks, disable VPN account configuration features if unused. Organizations should monitor vendor site for firmware updates and consider device replacement if active support has ceased. Consult VulDB entry https://vuldb.com/vuln/356605 and exploit details https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_174/README.md for attack surface understanding to inform network segmentation.