CVE-2026-6112

CWE-77 — Command InjectionCWE-78 — OS Command Injection4 documents4 sources
Severity
8.9HIGH
EPSS
0.9%
top 24.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Totolink A7100ru
Timeline
PublishedApr 12

Description

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument maxRtrAdvInterval causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5totolink/a7100ru7.4cu.2313_b20191024

🔴Vulnerability Details

3
GHSA
GHSA-49rw-2cx9-hjm3: A weakness has been identified in Totolink A7100RU 7↗2026-04-12
▶
CVEList
Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection↗2026-04-12
▶
VulDB
Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setRadvdCfg maxRtrAdvInterval os command injection↗2026-04-11
▶
CVE-2026-6112 (HIGH CVSS 8.9) | A weakness has been identified in T | cvebase.io