CVE-2026-6113
CRITICALTotolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection
Title source: cnaDescription
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTtyServiceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument ttyEnable leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Scores
CVSS v3
9.8
EPSS
0.0125
EPSS Percentile
79.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
CWE-78
Status
published
Products (1)
Totolink/A7100RU
7.4cu.2313_b20191024
Published
Apr 12, 2026
Tracked Since
Apr 12, 2026