PT-2026-32146 · Totolink · Totolink A7100Ru

Ltzhust2 · Published 2026-04-12 · Updated 2026-04-13 · CVE-2026-6113

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A security flaw exists in Totolink A7100RU 7.4cu.2313 b20191024. The setTtyServiceCfg function within the CGI Handler component, located in the file /cgi-bin/cstecgi.cgi, is susceptible to os command injection. Manipulation of the ttyEnable argument can lead to remote code execution. The exploit for this issue has been publicly disclosed.

Recommendations Disable the setTtyServiceCfg function in /cgi-bin/cstecgi.cgi until a patch is available.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-6113

Affected Products

Totolink A7100Ru

References · 11

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_178/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6113 · Security Note
• https://twitter.com/OrizonCyber/status/2043222636264616087 · Twitter Post
• https://twitter.com/CveFindCom/status/2043188097295262203 · Twitter Post
• https://totolink.net · Note
• https://twitter.com/CVEarity/status/2043319603183677681 · Twitter Post
• https://vuldb.com/vuln/356973/cti · Note
• https://twitter.com/ctiwatchcloud/status/2043298097363657013 · Twitter Post
• https://vuldb.com/vuln/356973 · Note
• https://twitter.com/PurpleOps_io/status/2043547587525906721 · Twitter Post
• https://vuldb.com/submit/792246 · Note