Critical RCE Flaw in Totolink A7100RU Routers Exposed

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-6154, has surfaced in Totolink A7100RU wireless routers, specifically firmware version 7.4cu.2313_b20191024. According to the National Vulnerability Database, this flaw resides within the setWizardCfg function of the /cgi-bin/cstecgi.cgi file, a component of the device’s CGI Handler.

Exploiting this vulnerability is straightforward: manipulating the wizard argument allows for arbitrary OS command injection. The attack vector is remote, meaning threat actors can compromise affected devices without needing local network access. With a CVSS score of 9.8, this vulnerability is as critical as it gets, signaling a severe risk to unpatched devices. The exploit code has already been made public, dramatically increasing the urgency for users to address this issue.

This type of command injection (CWE-77, CWE-78) is a classic attack vector for taking full control of network devices. Given the widespread use of consumer and small business routers, an RCE of this magnitude, especially with public exploit code, is a massive red flag. It’s a prime target for botnet recruitment or establishing persistent access within a network.