CVE-2026-6131 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-6131 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6131 is a critical severity vulnerability affecting the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024), specifically within the setTracerouteCfg function of the CGI handler located at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in the setTracerouteCfg function, which processes user-supplied input through the device's CGI interface without adequate validation or sanitization. An attacker can craft a malicious request to this endpoint to trigger the vulnerability, most likely resulting in remote code execution (RCE) on the underlying device operating system. Given the CVSS score of 9.8 and the nature of CGI-based command injection patterns common to this class of router firmware, exploitation would likely allow an unauthenticated attacker to execute arbitrary commands with elevated privileges on the affected device.

Exploitation Status

No known exploit code has been publicly identified at this time, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is assessed as no known exploit, meaning active in-the-wild exploitation has not been confirmed as of April 19, 2026. However, the critical CVSS score and the historically high targeting rate of consumer and SOHO router vulnerabilities warrant proactive remediation without waiting for confirmed exploitation.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns or targeted sectors have been associated with this CVE in available intelligence. It should be noted that vulnerabilities in SOHO and consumer-grade routers from vendors such as Totolink have historically attracted attention from botnet operators and opportunistic threat actors conducting mass scanning activity.

What To Do

Organizations and individuals operating the Totolink A7100RU on firmware version 7.4cu.2313_b20191024 should check immediately for an updated firmware release from Totolink and apply it as a priority given the critical severity rating. If no patch is available, administrators should restrict access to the device's web management interface by disabling remote administration and ensuring the CGI handler is not exposed to untrusted networks or the public internet. Network-level controls such as firewall rules blocking external access to port 80 and 443 on the device can reduce the attack surface. Detection efforts should focus on anomalous HTTP POST requests targeting /cgi-bin/cstecgi.cgi with unexpected or oversized parameter values in the traceroute configuration fields.