CVE-2026-5851

Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection

View on CVE.org
Published Apr 9, 2026 CVSS 4.0 · 9.3 Critical EPSS 13.6% KEV · Not listed
Description
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows a remote attacker to inject arbitrary operating system commands by manipulating the \"enable\" parameter of the setUPnPCfg function in /cgi-bin/cstecgi.cgi. This flaw, identified as a classic OS command injection (CWE‑77/78), can be triggered over the network, enabling the attacker to execute any command with the privileges of the router’s internal processes, effectively compromising the device’s confidentiality, integrity, and availability.

Affected Systems

Affected devices include the Totolink A7100RU router — the specific firmware revision 7.4cu.2313_b20191024. The component in question is the CGI Handler accessible via /cgi-bin/cstecgi.cgi, and the vulnerability is tied to the enable argument within the setUPnPCfg function.

Risk and Exploitability

The CVSS base score of 9.3 indicates a severe risk. The EPSS score of 13% indicates a low probability of exploitation. The presence of public exploit code confirms that the vulnerability can be and has been used in the wild. The flaw is not listed in the CISA KEV catalog, but because the attack vector is remote, does not require authentication, and can be performed with a simple crafted HTTP request, the risk to exposed or unmanaged routers is significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Totolink that addresses the CGI command injection flaw.
  • If an update is not yet available, disable UPnP functionality or restrict it to trusted internal networks.
  • Block or limit external access to /cgi-bin/cstecgi.cgi using firewall rules or network segmentation.
  • Monitor router logs for anomalous command executions and conduct regular security audits of network devices.

Generated by OpenCVE AI on October 25, 2026 at 20:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 9, 2026, 12:13 PM
Reserved
Apr 8, 2026, 7:19 PM

View source JSON

Updated
Apr 9, 2026, 12:13 PM

JSON

Status
Deferred
Published
Apr 9, 2026, 6:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON