CVE-2026-5692

Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection

View on CVE.org
Published Apr 6, 2026 CVSS 4.0 · 6.9 Medium EPSS 1.6% KEV · Not listed
Description
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used.

Analysis

AI-generated

Technical impact

Affects the setGameSpeedCfg function in the cstecgi.cgi CGI script of the A7100RU router. The enable parameter can be manipulated to inject arbitrary operating system commands through the web interface. The vulnerability is a classic OS command injection, corresponding to CWE-77 and CWE-78. Remote attackers can invoke the injection from outside the host, potentially gaining the ability to execute any command on the router’s operating system, which may compromise confidentiality, integrity, and availability of the device and the network it protects.

Affected Systems

Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024 are affected. This includes the cstecgi.cgi script located under /cgi-bin. No other vendor or product is currently listed as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. Exploitability is increased by the fact that the attack vector is remote and no special user credentials are required; the exploit has already been made public. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but if exploited, the command injection could allow arbitrary OS command execution, compromising the router and potentially the connected network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Totolink’s website or support portal for a firmware update that fixes the command injection in /cgi-bin/cstecgi.cgi.
  • If no update is available, limit all web‑admin access to the router to a trusted internal network and block remote access from the internet.
  • Disable or remove the cstecgi.cgi interface if the feature is not required, or block it via firewall rules.

Generated by OpenCVE AI on April 21, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used.
Title Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 7, 2026, 1:17 PM
Reserved
Apr 6, 2026, 10:27 AM

View source JSON

Updated
Apr 7, 2026, 1:17 PM

JSON

Status
Deferred
Published
Apr 7, 2026, 12:16 AM
Modified
Jul 24, 2026, 9:10 AM

View source JSON

No data.

Updated
Apr 21, 2026, 11:30 PM

JSON