CVE-2026-6029

CVE-2026-6029 is an OS command injection vulnerability in the Totolik A7100RU router (version 7.4cu.2313_b20191024) affecting the setVpnAccountCfg function within the CGI Handler component at /cgi-bin/cstecgi.cgi. The vulnerability exists in the User argument parameter, allowing attackers to inject and execute arbitrary operating system commands on the affected device. The vulnerability carries a CVSS v3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. A successful exploit grants attackers complete system compromise including confidentiality, integrity, and availability breaches. The FAUCET Risk Score of 55.0/100 indicates moderate to significant risk in real-world deployment scenarios. Public exploit code is currently available for this vulnerability, though it is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation trends. The exploit remains relatively low in community attention compared to similar critical vulnerabilities, as indicated by the EPSS percentile ranking. Organizations operating affected Totolik router models should prioritize patching or implement network-level access controls to restrict exposure of the vulnerable CGI interface.