PT-2026-32489 · Totolink · A7100Ru

Ltzhust · Published 2026-04-13 · Updated 2026-04-19 · CVE-2026-6195

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A security issue in the CGI Handler component allows for remote OS command injection. The problem exists in the setPasswordCfg() function within the '/cgi-bin/cstecgi.cgi' file. An unauthenticated attacker can exploit this by manipulating the admpass variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' file or disable the setPasswordCfg() function to minimize the risk of exploitation.

Exploit

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-6195

Affected Products

A7100Ru

References · 10

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_198/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6195 · Security Note
• https://vuldb.com/vuln/357117/cti · Note
• https://twitter.com/CVEnew/status/2045972421837271364 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/vuln/357117 · Note
• https://twitter.com/ctiwatchcloud/status/2044023123654131926 · Twitter Post
• https://twitter.com/OrizonCyber/status/2043758643686850924 · Twitter Post
• https://twitter.com/0dayPublishing/status/2043746017384755341 · Twitter Post
• https://vuldb.com/submit/797460 · Note