CVE-2026-6154: Totolink A7100RU OS Command Injection via setWizardCfg

CVE-2026-6154: Totolink A7100RU OS Command Injection

A critical OS command injection vulnerability has been disclosed in the Totolink A7100RU consumer router, tracked as CVE-2026-6154 with a CVSS score of 9.8 (Critical). The flaw resides in the setWizardCfg function of the /cgi-bin/cstecgi.cgi CGI handler and allows a remote, unauthenticated attacker to inject and execute arbitrary operating system commands on the affected device.

The vulnerability was published to the NVD on April 13, 2026, and affects routers running firmware version 7.4cu.2313_b20191024.

Vulnerability Overview

Technical Analysis

The Totolink A7100RU router exposes a CGI-based web management interface through /cgi-bin/cstecgi.cgi. This handler processes various administrative configuration functions. The setWizardCfg function is responsible for handling the device's initial setup wizard configuration.

Root Cause

The wizard parameter passed to setWizardCfg is incorporated into a shell command without adequate sanitization or input validation. The embedded Linux firmware executes this shell command as part of the setup wizard configuration process, and an attacker who can send a crafted HTTP request to the CGI handler can inject arbitrary shell metacharacters — such as semicolons, pipes, backticks, or $() expressions — to break out of the intended command and execute arbitrary OS commands with the privileges of the web server process (typically root on embedded router firmware).

Exploitation Path

1. Attacker identifies a Totolink A7100RU router on the network
   (or accessible via the WAN interface if remote management is enabled)
 
2. Attacker sends a crafted HTTP POST request to:
   http://<router-ip>/cgi-bin/cstecgi.cgi
 
3. Request body includes the setWizardCfg action with a malicious
   wizard parameter value, e.g.:
   {"action":"setWizardCfg","wizard":"valid_value; <malicious_command>"}
 
4. The firmware incorporates the wizard parameter into a shell
   command without sanitization
 
5. The injected OS command executes with elevated privileges
   (typically root on consumer router firmware)
 
6. Attacker achieves remote code execution on the router

Impact

On consumer router firmware, the web server and CGI handler commonly run with root privileges, meaning successful exploitation grants the attacker full control over the device. From there, an attacker can:

• Modify DNS settings to redirect traffic (DNS hijacking)
• Establish persistence by modifying router firmware or startup scripts
• Use the router as a pivot point to attack LAN-connected devices
• Intercept and inspect network traffic
• Add the device to a botnet
• Disable security features or open firewall rules

Affected Versions

Totolink had not issued a public patch or security advisory at the time of NVD publication. Users should check the Totolink support portal for firmware updates.

Remediation

Immediate Actions

1. Check for firmware updates — Visit the Totolink support site and download the latest firmware for the A7100RU. If a patched version is available, apply it immediately.

2. Disable remote management — If WAN-side web management is enabled, disable it immediately. Most consumer routers expose this vulnerability only from the LAN unless remote administration is explicitly enabled.

Totolink A7100RU Web UI:
Advanced → Remote Management → Disable

3. Restrict LAN access to the admin interface — If possible, restrict router admin access to specific trusted LAN IP addresses or MAC addresses.

4. Change default credentials — Ensure the router is not using default login credentials, which would lower the barrier for exploitation if the admin interface is accessible.

5. Place router behind a network boundary — Ensure the WAN interface of the router is not directly accessible from untrusted networks without additional filtering.

Network-Level Detection

Monitor for unusual router behavior that may indicate compromise:

# Check for unexpected DNS changes from your router
nslookup google.com <router-ip>
 
# Verify router firmware integrity if accessible via SSH
# (if SSH is enabled on the device)
cat /proc/version
ls -la /cgi-bin/
 
# Monitor for outbound connections from the router's IP
# at the upstream firewall or gateway level

Watch for:

• Unexpected DNS responses from the router that differ from known-good resolvers
• Unusual outbound connections from the router's WAN IP to unknown external hosts
• Router configuration changes not initiated by administrators
• Router becoming unresponsive or rebooting unexpectedly

Context: Totolink Router Vulnerability Pattern

Totolink routers have a history of OS command injection and buffer overflow vulnerabilities across their product line. These flaws frequently arise from a common embedded firmware development pattern: CGI handlers that pass user-controlled HTTP parameters directly into system(), popen(), or similar shell execution calls without sanitization.

The A7100RU specifically runs a variant of embedded Linux with a BusyBox shell, and the CGI handler processes are commonly executed as root. This makes command injection in any CGI parameter a direct path to full device compromise.

Related CVEs affecting Totolink products follow the same pattern and share the same root cause — lack of input sanitization in CGI handler functions. Organizations using Totolink equipment should audit all devices for pending security updates and consider whether the device's risk profile is appropriate for their network boundary.

Key Takeaways

1. CVE-2026-6154 is a CVSS 9.8 Critical OS command injection in the Totolink A7100RU router's setWizardCfg CGI function
2. The wizard parameter is passed unsanitized to a shell command, enabling arbitrary remote code execution
3. No authentication is required — any network-accessible device is potentially exploitable
4. Consumer router CGI handlers commonly run as root, making RCE equivalent to full device takeover
5. Disable WAN-side remote management immediately and apply firmware updates when available
6. This vulnerability is part of a broader pattern of CGI handler command injection in Totolink router firmware

Sources

• CVE-2026-6154 — NIST NVD