CVE-2026-6029: Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection
A vulnerability was detected in Totolink A7100RU 7.4cu.2313b20191024. The affected element is the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument User results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6029?
The severity of CVE-2026-6029 is high with a CVSS score of 8.9.
How do I fix CVE-2026-6029?
To fix CVE-2026-6029, it is recommended to update the Totolink A7100RU firmware to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-6029?
CVE-2026-6029 is an OS command injection vulnerability found in the CGI Handler of the Totolink A7100RU.
Can CVE-2026-6029 be exploited remotely?
Yes, CVE-2026-6029 can be exploited remotely by manipulating the User argument in the setVpnAccountCfg function.
What component is affected by CVE-2026-6029?
CVE-2026-6029 affects the CGI Handler component in the file /cgi-bin/cstecgi.cgi of the Totolink A7100RU.