Critical RCE Found in Totolink A7100RU Routers

The National Vulnerability Database (NVD) has disclosed a critical remote code execution (RCE) vulnerability, CVE-2026-6132, affecting Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. This isn’t some theoretical flaw; it’s a nasty OS command injection that’s been publicly disclosed, meaning the bad guys likely already have it in their exploit kits.

According to NVD, the vulnerability resides within the setLedCfg function of the /cgi-bin/cstecgi.cgi file, specifically within the CGI Handler component. Manipulating the enable argument allows an unauthenticated attacker to inject arbitrary operating system commands. With a CVSS v3.1 score of 9.8, this vulnerability is squarely in the critical territory. It’s a textbook example of CWE-77 and CWE-78, highlighting the dangers of insufficient input validation when interacting with system commands. Remote exploitation is possible, which is always a red flag, as it means an attacker doesn’t need local network access to wreak havoc.