Back infinitsec.net

Report: CVE-2026-6138 - Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection InfinitSec - Cyber Tech Crypto Gaming News / 2h Severity: 10.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... Impact: command injection

infinitsec.net • April 13, 2026

CVE ID :CVE-2026-6138 Published : April 13, 2026, 12:16 a.m. | 1 hour, 7 minutes ago Description :A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used. Severity: 10.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Command Injection Vulnerability in Totolink A7100RU (CVE-2026-6138) A critical vulnerability, CVE-2026-6138, has been identified in the Totolink A7100RU firmware version 7.4cu.2313_b20191024. This flaw allows unauthenticated remote attackers to execute arbitrary OS commands via command injection through the setAccessDeviceCfg function in the CGI Handler component. The vulnerability is actively being exploited, with a CVSS score of 9.8 indicating its severity. No patches or mitigations are currently available, leaving devices vulnerable to complete compromise. Users are advised to restrict network access and monitor for suspicious activity. The exploit has been published, and the potential for service disruption or data breach is significant. Other related vulnerabilities, such as CVE-2026-6157 and CVE-2026-6140, were also published on the same date, indicating a broader issue with Totolink devices. 2 sources 75

Extracted Entities

Report: CVE-2026-6138 - Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection InfinitSec - Cyber Tech Crypto Gaming News / 2h Severity: 10.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... Impact: command injection

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)