Back www.thehackerwire.com

CVE-2026-6138 TheHackerWire / 2h Attack Vector How the vulnerability can be exploited Network Scope Impact beyond vulnerable component Unchanged

www.thehackerwire.com • April 13, 2026

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

Modify values to recalculate the CVSS score in real-time

Stay informed the most severe security threats discovered this week

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Totolink A7100RU (CVE-2026-6138) A critical vulnerability, CVE-2026-6138, has been identified in the Totolink A7100RU firmware version 7.4cu.2313_b20191024. This flaw allows unauthenticated remote attackers to execute arbitrary OS commands via command injection through the setAccessDeviceCfg function in the CGI Handler component. The vulnerability is actively being exploited, with a CVSS score of 9.8 indicating its severity. No patches or mitigations are currently available, leaving devices vulnerable to complete compromise. Users are advised to restrict network access and monitor for suspicious activity. The exploit has been published, and the potential for service disruption or data breach is significant. Other related vulnerabilities, such as CVE-2026-6157 and CVE-2026-6140, were also published on the same date, indicating a broader issue with Totolink devices. 2 sources 75

Extracted Entities

CVE-2026-6138 TheHackerWire / 2h Attack Vector How the vulnerability can be exploited Network Scope Impact beyond vulnerable component Unchanged

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)