Which versions of A7100Ru are affected by CVE-2026-6154?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that allows attackers to gain complete control of the device without…

Is there a public PoC exploit available for CVE-2026-6154?

Yes, a public proof-of-concept exploit is available for CVE-2026-6154. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-6154?

Within 24 hours: Identify and inventory all Totolik A7100RU routers in your environment using network scanning tools and confirm firmware version via device administration interfaces. Within 7 days: Isolate affected routers from production networks or restrict administrative access via network segmentation and access control lists until firmware remediation is available. Within 30 days: Monitor Totolik vendor advisories for firmware release 7.4cu.2313_b20191025 or later; apply immediately upon availability. Implement compensating network controls including IPS/IDS rules to detect exploitation attempts against the setWizardCfg CGI function.

A7100Ru CVE-2026-6154

Q: What is the CVSS score of CVE-2026-6154?

CVE-2026-6154 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21808 HIGH

OS Command Injection (CWE-78)

2026-04-13 VulDB

GHSA-8cjf-hjff-67q2

Command Injection TOTOLINK A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 27, 2026 - 19:05 vuln.today

Public exploit code

Analysis Generated

Apr 13, 2026 - 04:24 vuln.today

Severity Changed

Apr 13, 2026 - 04:22 NVD

CRITICAL HIGH

CVSS changed

Apr 13, 2026 - 04:22 NVD

9.8 (CRITICAL) 8.9 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 04:15 euvd

EUVD-2026-21808

Analysis Generated

Apr 13, 2026 - 04:15 vuln.today

CVE Published

Apr 13, 2026 - 03:00 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via crafted wizard parameters to the setWizardCfg CGI function. Publicly available exploit code exists (GitHub POC), significantly lowering the barrier to exploitation. The CVSS 4.0 score of 8.9 reflects network-accessible attack vector with no authentication or user interaction required, enabling full compromise of router confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the CGI (Common Gateway Interface) handler in Totolink A7100RU wireless routers, specifically the setWizardCfg function invoked through /cgi-bin/cstecgi.cgi. The flaw is classified as CWE-78 (OS Command Injection), indicating that user-supplied input to the 'wizard' parameter is improperly sanitized before being passed to system shell commands. CGI scripts in embedded router firmware often execute with elevated privileges to configure network settings, DNS, routing tables, and other system-level functions. When input validation is absent or insufficient, attackers can break out of intended command contexts using shell metacharacters (semicolons, pipes, backticks) to inject arbitrary commands. The affected product CPE (cpe:2.3:a:totolink:a7100ru) identifies this as a Totolink application firmware component, with the specific vulnerable version being 7.4cu.2313_b20191024 released in October 2019. Router web interfaces commonly expose wizard setup functions to configure initial network settings, making this a high-value target for attackers seeking persistent network access.

RemediationAI

No vendor-released patch identified at time of analysis. Users should immediately check the official Totolink support portal at https://www.totolink.net/ for firmware updates newer than version 7.4cu.2313_b20191024, particularly security-focused releases issued after October 2019. If updated firmware is available, download directly from the vendor site and apply following manufacturer upgrade procedures, typically via the router's administration interface under System/Firmware Update sections. As interim mitigations until patching: disable remote administration features to eliminate internet-facing attack surface, restrict web interface access to trusted internal IP addresses only via firewall rules or router access controls, change default administrative credentials to strong unique passwords, place the router behind a separate firewall appliance if possible, and monitor logs for suspicious CGI access patterns to /cgi-bin/cstecgi.cgi. Organizations should consider replacing affected devices with actively supported models if the vendor has discontinued security updates for this 2019-era firmware branch. Network segmentation can limit blast radius if router compromise occurs, preventing lateral movement to critical assets.