CVE-2026-6140
OS Command Injection in Totolink A7100RU CGI Handler (Remote
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313_b20191024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-6140 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The CVE-2026-6140 vulnerability affects the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It is a command injection flaw located in the cstecgi.cgi component, specifically in the UploadFirmwareFile function.
An attacker can manipulate the 'FileName' parameter in a crafted HTTP POST request to /cgi-bin/cstecgi.cgi. This parameter is incorporated into a buffer and then executed by the system, allowing arbitrary operating system commands to run remotely on the router.
A proof of concept demonstrated that commands like 'wget' could be executed on the underlying OS, confirming the remote command execution capability.
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely execute arbitrary operating system commands on the affected TOTOLINK A7100RU router without any authentication.
Such remote command execution can lead to full compromise of the device, including unauthorized access, control over network traffic, installation of malware, or use of the router as a pivot point for further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the endpoint /cgi-bin/cstecgi.cgi, specifically those containing a JSON payload with the "FileName" parameter. An attacker may attempt to inject OS commands via this parameter.
To detect exploitation attempts, you can use network monitoring tools or web server logs to look for POST requests with unusual or suspicious command strings in the "FileName" parameter.
Example command to capture such requests using tcpdump (replace <interface> with your network interface):
- tcpdump -i <interface> -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /cgi-bin/cstecgi.cgi'
Alternatively, you can use curl or similar tools to test the endpoint by sending crafted POST requests with the "FileName" parameter to see if the system executes commands.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /cgi-bin/cstecgi.cgi to trusted networks or IP addresses only.
Disable or block HTTP POST requests to the UploadFirmwareFile function if possible, or apply firewall rules to prevent exploitation attempts.
Monitor network traffic and logs for suspicious activity targeting the "FileName" parameter.
If available, update the firmware of the Totolink A7100RU router to a version that patches this vulnerability.