CVE-2026-6115: Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection
A flaw has been found in Totolink A7100RU 7.4cu.2313b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the CGI endpoint /cgi-bin/cstecgi.cgi (and specifically the setAppCfg functionality) so it cannot be reached remotely (e.g., limit management/web UI access to trusted IPs via firewall/ACL).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6115?
CVE-2026-6115 has a high severity rating due to its potential for OS command injection vulnerabilities.
How do I fix CVE-2026-6115?
To mitigate CVE-2026-6115, it is recommended to update the Totolink A7100RU firmware to the latest version provided by the vendor.
What systems are affected by CVE-2026-6115?
CVE-2026-6115 specifically affects the Totolink A7100RU router running the 7.4cu.2313_b20191024 firmware version.
What type of vulnerability is CVE-2026-6115?
CVE-2026-6115 is categorized as an OS command injection vulnerability within the CGI handler of the device.
Could CVE-2026-6115 lead to remote exploitation?
Yes, CVE-2026-6115 can potentially allow remote attackers to execute malicious OS commands on the affected device.