Which versions of Totolink A7100RU are affected by CVE-2026-6029?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical command injection vulnerability allowing unauthenticated attackers to remotely execute arbitrary system commands and…

Is there a public PoC exploit available for CVE-2026-6029?

Yes, a public proof-of-concept exploit is available for CVE-2026-6029. Prioritise patching immediately. EPSS: 0.9%.

Totolink A7100RU CVE-2026-6029

Q: What is the CVSS score of CVE-2026-6029?

CVE-2026-6029 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21324 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

Command Injection

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 07:00 euvd

EUVD-2026-21324

Analysis Generated

Apr 10, 2026 - 07:00 vuln.today

CVE Published

Apr 10, 2026 - 06:30 nvd

HIGH 8.9

DescriptionNVD

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. …

RemediationAI

Within 24 hours: Identify all Totolik A7100RU routers in your environment and isolate firmware version 7.4cu.2313_b20191024 devices from untrusted networks; check vendor (Totolik) security advisory for available firmware updates and apply immediately if released. Within 7 days: Complete inventory of all affected devices and verify firmware version across all instances; implement network segmentation to restrict access to router management interfaces to authorized administrative subnets only. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-6029 vulnerability details – vuln.today

Back

Totolink A7100RU CVE-2026-6029

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

Totolink A7100RU CVE-2026-6029

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code