Which versions of A7100Ru are affected by CVE-2026-6115?

Totolik A7100RU router firmware versions up to 7.4cu.2313_b20191024 contain a critical unauthenticated remote command injection vulnerability allowing attackers to fully compromise affected devices…

Is there a public PoC exploit available for CVE-2026-6115?

Yes, a public proof-of-concept exploit is available for CVE-2026-6115. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6115?

Within 24 hours: Identify and inventory all Totolik A7100RU devices in production and take them offline or isolate to a quarantined network segment; notify affected business units. Within 7 days: Contact Totolik support to confirm patch availability status and request emergency firmware release timeline; implement network segmentation to restrict router access. Within 30 days: Once vendor-released patch becomes available, establish staged firmware deployment plan and apply to all affected devices; conduct network forensics on affected routers for signs of prior compromise.

A7100Ru CVE-2026-6115

Q: What is the CVSS score of CVE-2026-6115?

CVE-2026-6115 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21706 HIGH

OS Command Injection (CWE-78)

2026-04-12 VulDB

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 19:05 vuln.today

Public exploit code

Severity Changed

Apr 12, 2026 - 05:22 NVD

CRITICAL HIGH

CVSS changed

Apr 12, 2026 - 05:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Apr 12, 2026 - 05:05 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 05:00 euvd

EUVD-2026-21706

Analysis Generated

Apr 12, 2026 - 05:00 vuln.today

CVE Published

Apr 12, 2026 - 04:00 nvd

HIGH 8.9

DescriptionCVE.org

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setAppCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector, low complexity, and no authentication required. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no CISA KEV listing indicates targeted campaigns have not been observed at time of analysis.

Technical ContextAI

This vulnerability affects the CGI (Common Gateway Interface) handler in Totolink A7100RU wireless router firmware, specifically within the setAppCfg function accessible via /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-78 (OS Command Injection), where user-supplied input to the 'enable' parameter is not properly sanitized before being passed to system shell commands. CGI scripts in embedded device firmware frequently suffer from insufficient input validation when interfacing between web requests and underlying Linux system calls. The affected product (CPE 2.3:a:totolink:a7100ru) is a consumer-grade wireless router, and the vulnerable firmware version 7.4cu.2313_b20191024 was released in October 2019. Command injection flaws in router administration interfaces are particularly severe because they grant attackers direct system-level access to the device's operating system, bypassing application-layer controls entirely.

RemediationAI

No vendor-released patch identified at time of analysis from available reference data. Organizations using Totolink A7100RU routers should immediately check the vendor website at https://www.totolink.net/ and contact Totolink technical support directly to inquire about patched firmware releases addressing CVE-2026-6115. As immediate risk mitigation, restrict network access to the router's administrative interface (/cgi-bin/ endpoints) to trusted management networks only, blocking internet-facing access via firewall rules or disabling remote administration features entirely. Implement network segmentation to isolate affected routers from critical infrastructure. Monitor for unusual outbound connections or system command execution patterns. Given the age of the vulnerable firmware (October 2019) and typical end-of-life cycles for consumer networking equipment, organizations should evaluate replacing affected devices with current-generation routers from vendors with stronger security update commitments. Review VulDB advisory at https://vuldb.com/vuln/356975 and the public exploit repository at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_180/README.md to understand specific attack patterns for detection signature development.