The vulnerability CVE-2026-6112 affects the Totolink A7100RU router firmware 7.4cu.2313_b20191024. It arises from improper input validation in the setRadvdCfg function of the /cgi-bin/cstecgi.cgi CGI handler. Specifically, the maxRtrAdvInterval parameter can be manipulated to inject and execute arbitrary operating system commands remotely. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. The exploit code is publicly available, increasing the risk of exploitation. No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control over network traffic, data interception, or disruption of network services. The vulnerability requires no authentication or user interaction, making it highly exploitable. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability of the device and network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling remote management features if enabled, restrict access to the device's management interface to trusted networks, and monitor for unusual device behavior. Avoid exposing the device's management interface directly to the internet. Follow updates from Totolink for any forthcoming patches or official mitigations.