CVE-2026-6155
OS Command Injection in Totolink A7100RU CGI Handler (Remote
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary system commands on the affected Totolink A7100RU router by exploiting a command injection flaw. Such unauthorized command execution can lead to unauthorized access, data breaches, or disruption of services.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the presence of this vulnerability could potentially impact compliance by exposing sensitive data or compromising system integrity, which are critical requirements under these regulations.
Organizations using the affected device may face increased risk of non-compliance due to potential data confidentiality, integrity, and availability issues arising from exploitation of this vulnerability.
Can you explain this vulnerability to me?
CVE-2026-6155 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313. It exists in the CGI script /cgi-bin/cstecgi.cgi, specifically in the function that processes the pppoeServiceName parameter.
An attacker can send a specially crafted HTTP POST request with malicious content in the pppoeServiceName parameter. This input is passed through several internal functions and eventually executed as an operating system command on the router.
This allows remote attackers to execute arbitrary system commands on the device without any authentication.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary commands on the affected router, potentially taking full control of the device.
- Attackers could manipulate the router’s configuration or network traffic.
- They could install malicious software or create backdoors.
- It could lead to interception or disruption of network communications.
- The router could be used as a pivot point for further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP POST requests sent to the /cgi-bin/cstecgi.cgi endpoint, specifically looking for the pppoeServiceName parameter containing suspicious or command injection payloads.
A practical detection method is to capture and analyze network traffic for POST requests with the pppoeServiceName parameter set to unusual values such as commands (e.g., wget or other shell commands).
- Use a network packet capture tool like tcpdump or Wireshark to filter HTTP POST requests to /cgi-bin/cstecgi.cgi.
- Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'pppoeServiceName'
- Alternatively, use curl or similar tools to test the endpoint by sending crafted POST requests with suspicious pppoeServiceName values to see if the device executes commands.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable CGI endpoint, applying input validation or filtering on the pppoeServiceName parameter, and updating the device firmware if a patch is available.
Since the vulnerability allows remote command execution, it is critical to limit network exposure of the affected device by placing it behind a firewall or disabling remote management features.
If possible, disable or restrict the use of the /cgi-bin/cstecgi.cgi interface until a vendor patch or update is applied.