CVE-2026-6113 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-6113 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6113 is a critical vulnerability affecting the setTtyServiceCfg function within the /cgi-bin/cstecgi.cgi CGI handler on the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024.

Technical Detail

The flaw resides in the C-language implementation of the setTtyServiceCfg function, which processes user-supplied input without adequate validation or bounds checking, a pattern consistent with a stack-based or heap-based buffer overflow leading to remote code execution. An unauthenticated or authenticated remote attacker can send a crafted HTTP request to the CGI endpoint to trigger the vulnerable code path. Successful exploitation would likely grant the attacker arbitrary command execution at the privilege level of the web server process, which on embedded routers of this class typically runs as root.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit as of April 18, 2026. However, the CVSS score of 9.8 and the nature of the affected component make this a high-priority target for future weaponization, particularly given the history of similar Totolink CGI vulnerabilities being rapidly exploited after disclosure.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Historically, vulnerabilities in consumer and small-office routers from vendors such as Totolink have been leveraged by botnet operators targeting IoT devices for DDoS infrastructure or persistent network access, but no such activity has been confirmed for this specific CVE.

What To Do

Organizations and individuals operating the Totolink A7100RU on firmware version 7.4cu.2313_b20191024 should check the Totolink vendor advisory for an updated firmware release and apply it immediately upon availability. If no patch is available, restrict access to the device management interface by placing it behind a firewall or access control list that limits exposure of the CGI endpoint to trusted hosts only. Remote management interfaces should be disabled if not operationally required. Network defenders should monitor for anomalous HTTP POST requests targeting /cgi-bin/cstecgi.cgi with oversized or malformed parameters as a potential detection signal. Given the critical CVSS rating, treat this as a high-priority remediation item regardless of current exploit availability.