Which versions of A7100Ru are affected by CVE-2026-6113?

Totolik A7100RU routers (version 7.4cu.2313_b20191024 and potentially earlier) contain a critical OS command injection vulnerability that allows unauthenticated attackers to remotely execute…

Is there a public PoC exploit available for CVE-2026-6113?

Yes, a public proof-of-concept exploit is available for CVE-2026-6113. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6113?

Within 24 hours: Identify and inventory all Totolik A7100RU devices on your network (check management interfaces and DHCP logs for the MAC prefix). Within 7 days: Contact Totolik support to confirm patch availability status and request urgent firmware updates; simultaneously implement network segmentation to isolate affected routers from sensitive systems and restrict administrative access. Within 30 days: Either deploy patched firmware when available or evaluate replacement with alternative router hardware from actively-maintained vendors; conduct forensic review of router logs and connected systems for signs of compromise.

A7100Ru CVE-2026-6113

Q: What is the CVSS score of CVE-2026-6113?

CVE-2026-6113 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21702 HIGH

OS Command Injection (CWE-78)

2026-04-12 VulDB

Command Injection TOTOLINK A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 19:05 vuln.today

Public exploit code

Severity Changed

Apr 12, 2026 - 04:22 NVD

CRITICAL HIGH

CVSS changed

Apr 12, 2026 - 04:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Apr 12, 2026 - 04:05 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 04:00 euvd

EUVD-2026-21702

Analysis Generated

Apr 12, 2026 - 04:00 vuln.today

CVE Published

Apr 12, 2026 - 03:00 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTtyServiceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument ttyEnable leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the ttyEnable parameter in the setTtyServiceCfg function of /cgi-bin/cstecgi.cgi. Public exploit code is available (GitHub POC published). CVSS 9.8 critical severity with network vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis, representing immediate risk to internet-facing devices.

Technical ContextAI

This vulnerability (CWE-78: OS Command Injection) affects the CGI handler component in Totolink A7100RU wireless routers, specifically targeting the setTtyServiceCfg function within the cstecgi.cgi script. The vulnerability stems from insufficient input validation on the ttyEnable parameter, which appears to control TTY service configuration settings. When processing this parameter, the CGI handler fails to properly sanitize user input before passing it to system shell commands. This allows injection of arbitrary shell metacharacters and commands that execute with the privileges of the web server process, typically root on embedded router platforms. The CPE identifier cpe:2.3:a:totolink:a7100ru confirms the affected product as Totolink's A7100RU router line. The network-accessible nature of the CGI endpoint combined with no authentication requirement (PR:N in CVSS vector) makes this a pre-authentication remote code execution vulnerability exploitable from the WAN interface if exposed.

RemediationAI

No vendor-released patch identified at time of analysis. Upstream fix available (GitHub POC repository documents the vulnerability but does not reference an official Totolink firmware update). Immediate mitigation requires restricting network access to the web management interface: disable remote administration features, implement firewall rules blocking external access to TCP ports 80/443 and the CGI endpoint, and ensure management interfaces are accessible only from trusted internal networks. For organizations requiring remote management, deploy VPN access controls or IP allowlisting. Monitor Totolink's official support channels and firmware download page (https://www.totolink.net/) for security updates addressing CVE-2026-6113. Consider replacing affected devices with actively maintained alternatives if vendor does not release timely security patches, given the critical nature of pre-authentication RCE vulnerabilities in perimeter network devices. Conduct network scans to inventory deployed A7100RU devices and verify management interface exposure.