CVE-2026-6140 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-6140 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-6140 is a critical vulnerability in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024), specifically affecting the UploadFirmwareFile function within the CGI handler at /cgi-bin/cstecgi.cgi.

Technical Detail

The flaw resides in improper input handling within the UploadFirmwareFile function of the CGI handler, where a crafted request can be used to manipulate the firmware upload process in an unintended way. Based on the vulnerability class and CVSS score of 9.8, the most likely impact is unauthenticated remote code execution, allowing an attacker to gain full control of the affected device by sending a malicious request to the exposed CGI endpoint. Given that this is a network-accessible interface on a consumer and small business router, successful exploitation would grant an attacker persistent access to the device and the ability to intercept or redirect network traffic.

Exploitation Status

No known exploit code has been publicly identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit, meaning active in-the-wild exploitation has not been confirmed as of April 19, 2026. This status should be monitored closely given the critical severity and the nature of the affected component.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Totolink devices have historically been targeted by botnet operators, particularly those deploying Mirai variants, and this class of vulnerability on an internet-facing router warrants monitoring for such activity.

What To Do

Organizations and individuals using the Totolink A7100RU running firmware version 7.4cu.2313_b20191024 should check for an updated firmware release from Totolink and apply it immediately given the critical CVSS score of 9.8. If no patch is available, restrict access to the device management interface by blocking external access to /cgi-bin/cstecgi.cgi at the network perimeter and ensuring the device is not directly exposed to the internet. As an additional precaution, place the device behind a firewall and disable remote management features until a vendor patch is confirmed and applied. Monitor device logs for unexpected firmware upload attempts or anomalous CGI requests as potential indicators of exploitation attempts.