Junglewise Threat Intelligence

CVE-2026-6131: Totolink A7100RU command injection in setTracerouteCfg

CVE-2026-6131 · Severity: critical · CVSS 9.8 · Published 2026-04-12

Technologies: TOTOLINK A7100ru. Vendors: TOTOLINK.

Executive brief

A vulnerability exists in the Totolink A7100RU, a wireless router used for home and office networking. An attacker can remotely take full control of the device by sending a specially crafted request to the router's management interface. This could lead to the interception of internet traffic, unauthorized access to the local network, or a complete disruption of internet services.

Technical details

An OS command injection vulnerability exists in the Totolink A7100RU firmware version 7.4cu.2313_b20191024. The flaw is located within the 'setTracerouteCfg' function of the '/cgi-bin/cstecgi.cgi' handler. The application fails to properly sanitize the 'command' argument before passing it to 'snprintf' and subsequently executing it via 'execv()' through the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) to execute arbitrary system commands with elevated privileges. Public exploit code (PoC) is available.

Affected products

  • Totolink A7100RU 7.4cu.2313_b20191024

Timeline

  • 2026-04-12: disclosed: Vulnerability reported via VulDB and GitHub PoC
  • 2026-04-12: advisory: NVD published the CVE record

References