CVE-2026-6139 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-6139 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6139 is a critical vulnerability in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024), specifically affecting the UploadOpenVpnCert function within the CGI handler at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in the CGI-based web management interface of the Totolink A7100RU, where the UploadOpenVpnCert function fails to properly validate or sanitize attacker-supplied input during OpenVPN certificate upload operations. An attacker can manipulate the input passed to this function to trigger the vulnerability, which based on the CVSS score of 9.8 and the nature of similar CGI handler flaws in this device family, is consistent with unauthenticated remote code execution or arbitrary command injection on the underlying operating system. Successful exploitation would grant an attacker full control over the affected device, enabling network pivoting, traffic interception, or use of the router as a persistent foothold.

Exploitation Status

No known exploit code has been publicly observed or confirmed at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. However, the critical CVSS score and the fact that similar CGI handler vulnerabilities in Totolink devices have historically attracted rapid weaponization mean this should not be treated as low urgency.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been confirmed in association with this vulnerability. Totolink router vulnerabilities as a class have previously been exploited by botnet operators targeting SOHO network devices, but no such activity has been confirmed for this specific CVE.

What To Do

Administrators running Totolink A7100RU devices on firmware version 7.4cu.2313_b20191024 should check immediately for a vendor-supplied firmware update and apply it as a priority given the critical severity rating. If no patch is available, restrict access to the device's web management interface by disabling remote administration and limiting access to trusted internal hosts only. Where possible, place the management interface behind a firewall or VPN and monitor CGI handler traffic for anomalous upload requests targeting /cgi-bin/cstecgi.cgi. Given the attack surface is network-accessible and likely unauthenticated, exposure of the management interface to the public internet should be treated as an unacceptable risk until a patch is confirmed applied.