CVE-2026-6112: Totolink A7100RU RCE Vulnerability

CVE-2026-6112 Overview

A critical OS command injection vulnerability has been identified in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The vulnerability exists in the setRadvdCfg function within the CGI handler component (/cgi-bin/cstecgi.cgi). An attacker can exploit this flaw by manipulating the maxRtrAdvInterval argument to inject and execute arbitrary operating system commands on the affected device. This vulnerability can be exploited remotely without authentication, potentially allowing complete compromise of the router and the network it protects.

Critical Impact

Remote attackers can execute arbitrary OS commands on vulnerable Totolink A7100RU routers, potentially leading to complete device compromise, network infiltration, and persistent access to the victim's infrastructure.

Affected Products

• Totolink A7100RU firmware version 7.4cu.2313_b20191024
• CGI Handler component (/cgi-bin/cstecgi.cgi)
• setRadvdCfg function

Discovery Timeline

• 2026-04-12 - CVE-2026-6112 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-6112

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection). The setRadvdCfg function in the Totolink A7100RU router's CGI handler fails to properly sanitize the maxRtrAdvInterval parameter before incorporating it into system commands. When a user-supplied value is passed to this parameter, it is processed without adequate validation, allowing an attacker to append malicious shell commands that will be executed by the underlying operating system with the privileges of the web service.

The network-accessible nature of this vulnerability is particularly concerning as it requires no authentication and no user interaction to exploit. An attacker with network access to the router's management interface can send specially crafted HTTP requests to the /cgi-bin/cstecgi.cgi endpoint to trigger command execution.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the setRadvdCfg function. The function accepts the maxRtrAdvInterval argument from user-controlled input and passes it directly to system command execution routines without proper escaping or validation. This allows shell metacharacters and command separators (such as ;, |, &&, or backticks) to break out of the intended command context and execute arbitrary commands.

Attack Vector

The attack is initiated remotely over the network by sending a malicious HTTP request to the router's CGI handler. The attacker crafts a request to the /cgi-bin/cstecgi.cgi endpoint with a manipulated maxRtrAdvInterval parameter containing injected shell commands.

For example, an attacker could append shell metacharacters followed by malicious commands to the parameter value. When the setRadvdCfg function processes this input, the injected commands are executed on the router's operating system. The exploit for this vulnerability has been publicly disclosed and documented, making it accessible to threat actors.

Technical details and proof-of-concept information are available in the GitHub PoC Repository and the VulDB vulnerability entry.

Detection Methods for CVE-2026-6112

Indicators of Compromise

• Unusual HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in parameter values
• Unexpected processes spawned by the router's web server process
• Modified system files or configurations on the router
• Outbound connections from the router to unknown external IP addresses
• Presence of unfamiliar scripts or binaries in router filesystem

Detection Strategies

• Monitor network traffic for HTTP requests to /cgi-bin/cstecgi.cgi containing suspicious characters such as ;, |, &&, $(, or backticks in the maxRtrAdvInterval parameter
• Implement intrusion detection rules to flag command injection patterns targeting Totolink router CGI endpoints
• Deploy network-based anomaly detection to identify unusual command-and-control traffic originating from router IP addresses
• Review router logs for failed or unusual authentication attempts and configuration changes

Monitoring Recommendations

• Enable comprehensive logging on network perimeter devices to capture traffic to and from router management interfaces
• Restrict management interface access to trusted internal networks only and monitor for any external access attempts
• Implement regular integrity checking of router firmware and configuration files
• Use SentinelOne Singularity to monitor endpoints on the network for post-exploitation activity that may originate from a compromised router

How to Mitigate CVE-2026-6112

Immediate Actions Required

• Restrict access to the router's management interface by disabling remote administration or limiting it to specific trusted IP addresses
• Implement network segmentation to isolate the router's management interface from untrusted networks
• Deploy a web application firewall (WAF) or intrusion prevention system (IPS) rules to block command injection attempts targeting the vulnerable endpoint
• Monitor for exploitation attempts and investigate any suspicious activity immediately
• Consider replacing the affected device with a router from a vendor with better security support if no patch is available

Patch Information

At the time of publication, no official patch from Totolink has been confirmed for this vulnerability. Users are advised to monitor the Totolink official website for firmware updates and security advisories. Apply any available firmware updates immediately upon release.

Additional technical information is available through VulDB Submission #792245 and the VulDB CTI entry.

Workarounds

• Disable remote management access to the router's web interface entirely until a patch is available
• Place the router behind a properly configured firewall that blocks external access to the CGI handler endpoints
• Use VPN access for any necessary remote administration rather than exposing the management interface directly
• Implement access control lists (ACLs) on the router to restrict which IP addresses can reach the management interface

# Example: Restrict management interface access via iptables on upstream device
# Block external access to router management port (typically 80/443)
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP

# Allow access only from trusted management network
iptables -I FORWARD -s <TRUSTED_MGMT_NETWORK> -d <ROUTER_IP> -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -s <TRUSTED_MGMT_NETWORK> -d <ROUTER_IP> -p tcp --dport 443 -j ACCEPT