Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-6025: Totolink A7100RU: Unauthenticated Remote Command Execution

CVE-2026-6025 · published 6 months ago

Summary

A flaw in the Totolink A7100RU router allows an attacker to execute arbitrary system commands without authentication. This means an attacker can take control of the router and potentially disrupt or misuse the network. Update the router's firmware to fix the issue.

Original advisory text

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

8.9 High

Exploitation

3% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-78OS Command Injection

Timeline

Published10 Apr 2026

Updated3 Nov 2026

First seen10 Apr 2026

Sources

CVE-2026-6025 · NVD

Track software like this

Free during beta