CVE-2026-6155

CVE-2026-6155 is an OS command injection vulnerability in Totolik A7100RU router firmware version 7.4cu.2313, specifically within the setWanCfg function of the CGI handler component. An attacker can manipulate the pppoeServiceName parameter to inject and execute arbitrary operating system commands on the affected device. This vulnerability carries a critical CVSS score of 9.8, indicating severe risk with high impact across confidentiality, integrity, and availability. The vulnerability presents a network-based attack vector requiring no authentication or user interaction, making it trivially exploitable by remote threat actors. With low attack complexity and universal scope, any unauthenticated attacker on the network can potentially gain full system control of affected routers. Public exploit code has been released, significantly lowering the barrier to entry for exploitation. While the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and community attention remains relatively low as indicated by its inactive hot list status, the availability of public exploits combined with the critical severity rating presents a substantial risk to organizations operating Totolik A7100RU devices. Immediate patching or device replacement should be prioritized for affected deployments.