PT-2026-32187 · Totolink · Totolink A7100Ru

Ltzhuster

·

CVE-2026-6140

·

Published

2026-04-12

·

Updated

2026-04-14

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024
Description A flaw exists in the CGI Handler component of Totolink A7100RU version 7.4cu.2313 b20191024. Specifically, manipulating the FileName argument within the UploadFirmwareFile function, accessible via the '/cgi-bin/cstecgi.cgi' endpoint, can lead to os command injection. This allows for remote exploitation.
Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

CVE-2026-6140

Affected Products

Totolink A7100Ru