Skip to main content

Totolink A7100RU CVE-2026-6138

| EUVD-2026-21761 HIGH
OS Command Injection (CWE-78)
2026-04-13 VulDB GHSA-4gxr-jwfr-c55p
Command Injection
8.9
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

8
Re-analysis Queued
Apr 27, 2026 - 19:07 vuln.today
cvss_changed
PoC Detected
Apr 27, 2026 - 19:05 vuln.today
Public exploit code
Severity Changed
Apr 13, 2026 - 00:22 NVD
CRITICAL HIGH
CVSS changed
Apr 13, 2026 - 00:22 NVD
9.8 (CRITICAL) 8.9 (HIGH)
Analysis Generated
Apr 13, 2026 - 00:17 vuln.today
EUVD ID Assigned
Apr 13, 2026 - 00:15 euvd
EUVD-2026-21761
Analysis Generated
Apr 13, 2026 - 00:15 vuln.today
CVE Published
Apr 13, 2026 - 00:00 nvd
HIGH 8.9

DescriptionNVD

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via a crafted MAC address parameter to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. CVSS 9.8 (Critical) with publicly available exploit code on GitHub. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: identify and inventory all Totolik A7100RU routers in production, especially those accessible from the internet; isolate affected devices from management networks if firmware update is not immediately available. Within 7 days: contact Totolik for firmware updates or migrate to alternative router platforms; if devices must remain in service, implement network segmentation and restrict administrative access to trusted IP ranges only. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-6138 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy