Is Command Injection affected by CVE-2026-6115?

Totolik A7100RU router firmware versions up to 7.4cu.2313_b20191024 contain a critical unauthenticated remote command injection vulnerability allowing attackers to fully compromise affected devices without credentials.

CVE-2026-6115

EUVD-2026-21706 HIGH

2026-04-12 VulDB

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 12, 2026 - 05:22 NVD

CRITICAL HIGH

CVSS Changed

Apr 12, 2026 - 05:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Apr 12, 2026 - 05:05 vuln.today

Description

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.

Analysis

OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setAppCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector, low complexity, and no authentication required. …

Remediation

Within 24 hours: Identify and inventory all Totolik A7100RU devices in production and take them offline or isolate to a quarantined network segment; notify affected business units. Within 7 days: Contact Totolik support to confirm patch availability status and request emergency firmware release timeline; implement network segmentation to restrict router access. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.9

CVSS: +44

POC: +20

CVE-2026-6115 vulnerability details – vuln.today

Back

CVE-2026-6115

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-6115

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code