CVE-2026-6114: Totolink A7100RU RCE Vulnerability

CVE-2026-6114 Overview

CVE-2026-6114 is an operating system command injection vulnerability affecting the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The flaw resides in the setNetworkCfg function within /cgi-bin/cstecgi.cgi, a component of the CGI Handler. Attackers can manipulate the proto argument to inject and execute arbitrary operating system commands. The vulnerability is remotely exploitable without authentication or user interaction. A public exploit is available, increasing the risk of opportunistic attacks against exposed devices.

Critical Impact

Unauthenticated remote attackers can execute arbitrary OS commands on affected routers, leading to full device compromise and potential pivoting into internal networks.

Affected Products

• Totolink A7100RU router
• Firmware version 7.4cu.2313_b20191024
• CGI Handler component (/cgi-bin/cstecgi.cgi)

Discovery Timeline

• 2026-04-12 - CVE-2026-6114 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-6114

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-77]. It exists in the setNetworkCfg function of the cstecgi.cgi binary, which handles configuration requests on the Totolink A7100RU router. The proto parameter, supplied via HTTP requests to the CGI endpoint, is passed to a system shell without proper sanitization or input validation. An attacker can append shell metacharacters to the parameter value to break out of the intended command context and execute arbitrary commands. Because the CGI process runs with elevated privileges on embedded Linux firmware, successful exploitation typically yields root-level command execution on the device.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The setNetworkCfg handler concatenates attacker-controlled input from the proto argument directly into a shell command string. The absence of input filtering, allowlisting, or safe API usage (such as execve with argument arrays) enables shell interpretation of injected characters like ;, |, &, and backticks.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with a malicious proto parameter targeting the setNetworkCfg function. The injected payload is interpreted by the underlying shell, executing attacker-supplied commands. Public proof-of-concept code is available, lowering the technical barrier for exploitation. Devices exposed to the internet or untrusted network segments are at immediate risk.

A public proof-of-concept describing the exact request format is documented in the GitHub PoC Repository and the VulDB #356974 entry.

Detection Methods for CVE-2026-6114

Indicators of Compromise

• HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, &, backticks, $()) in the proto parameter
• Unexpected outbound connections from the router to external hosts not associated with normal DNS, NTP, or firmware update traffic
• New or modified files in writable firmware paths such as /tmp or /var
• Unauthorized changes to router network configuration or DNS settings

Detection Strategies

• Inspect HTTP traffic to the router's management interface for requests targeting setNetworkCfg with anomalous proto values
• Deploy network intrusion detection signatures that flag command injection patterns in CGI parameters
• Correlate router-originated traffic with endpoint and identity telemetry to identify lateral movement attempts

Monitoring Recommendations

• Log and monitor administrative access attempts to the router web interface
• Alert on outbound connections from the router to non-allowlisted destinations
• Track firmware integrity and configuration drift on managed network devices

How to Mitigate CVE-2026-6114

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal hosts only and disable remote WAN administration
• Place affected devices behind a perimeter firewall and block inbound access to /cgi-bin/cstecgi.cgi from untrusted networks
• Audit the device for signs of compromise, including unexpected processes, modified configurations, and unknown outbound connections
• Replace the device with a supported model if no vendor patch is forthcoming

Patch Information

At the time of publication, no official vendor patch has been referenced in the CVE record. Check the Totolink Official Website for firmware updates addressing the setNetworkCfg command injection issue. If a fixed firmware version is released, apply it immediately on all affected A7100RU devices.

Workarounds

• Disable the router's web administration interface on the WAN side and limit LAN-side access by source IP
• Segment the router onto a management VLAN isolated from production user networks
• Apply ACLs at the upstream gateway to drop external HTTP/HTTPS traffic destined for the router's management ports
• Replace end-of-support devices with vendor-supported hardware that receives security updates