CVE-2026-6195

high · 8.9

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

8.9

CVSS

13.5%

EPSS (exploit prob.)

96th

EPSS percentile

2026-04-13

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-77CWE-78

References

https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_198/README.md
https://vuldb.com/submit/797460
https://vuldb.com/vuln/357117
https://vuldb.com/vuln/357117/cti
https://www.totolink.net/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-6195