Cyber Posture

CVE-2026-6029

Critical

Published: 10 April 2026

Published
10 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched…

more

remotely. The exploit is now public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by validating the 'User' argument in the vulnerable setVpnAccountCfg CGI function.

SI-2 Flaw Remediation good match
prevent

Remediates the specific command injection flaw in the Totolink A7100RU firmware through identification, reporting, and correction.

AC-3 Access Enforcement good match
prevent

Enforces authentication and access controls to block unauthenticated remote exploitation of the CGI handler vulnerability.

Security SummaryAI

CVE-2026-6029 is an OS command injection vulnerability affecting the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setVpnAccountCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the "User" argument enables command injection. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-10.

The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation allows arbitrary OS command execution on the device, potentially granting high-impact confidentiality, integrity, and availability compromises, such as full router control, data theft, or further network pivoting.

Advisories from VulDB (vuln/356605) and a related GitHub repository detail the vulnerability and provide a public exploit in the form of a README.md file, confirming remote exploitability. The manufacturer's site (totolink.net) is referenced, but no specific patches or mitigations are outlined in the available sources.

The exploit is publicly available and may be used, increasing the risk for unpatched Totolink A7100RU devices exposed to the internet.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of public-facing web application (T1190) via unauthenticated remote OS command injection in router CGI, directly facilitating Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References