Totolink A7100RU Routers Hit by Critical OS Command Injection

The National Vulnerability Database (NVD) has flagged CVE-2026-6138, a critical OS command injection vulnerability impacting Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. This isn’t some theoretical flaw; NVD reports that an exploit for this vulnerability has already been published, meaning it’s likely already in the wild, or will be soon.

Specifically, the flaw resides within the setAccessDeviceCfg function of the /cgi-bin/cstecgi.cgi file, a component handled by the device’s CGI Handler. Malicious manipulation of the mac argument within this function allows for remote operating system command injection. With a CVSS score of 9.8, this vulnerability is as critical as it gets, posing a severe risk to affected devices. The attack vector is network-based, requires low attack complexity, and needs no privileges or user interaction, allowing for complete compromise of confidentiality, integrity, and availability. This is a prime example of why proper input validation is non-negotiable, especially in network-facing devices.