Critical RCE Flaw Hits Totolink Routers

The National Vulnerability Database (NVD) recently disclosed a critical remote code execution (RCE) vulnerability, CVE-2026-6131, affecting Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. This isn’t just some run-of-the-mill bug; we’re talking about a CVSS score of 9.8, which is as bad as it gets.

The vulnerability resides within the setTracerouteCfg function, specifically in the /cgi-bin/cstecgi.cgi component’s CGI Handler. Manipulating the command argument allows for OS command injection, meaning an attacker can remotely execute arbitrary commands on the device. The NVD notes that an exploit for this flaw has already been made public, significantly increasing the immediate risk. This is a classic example of CWE-77 and CWE-78, highlighting the dangers of insufficient input validation when interacting with system commands. Given the public exploit, this isn’t a theoretical threat; it’s a clear and present danger to unpatched devices.