CVE-2026-5852

Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection

View on CVE.org
Published Apr 9, 2026 CVSS 4.0 · 9.3 Critical EPSS 13.7% KEV · Not listed
Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability resides in the setIptvCfg function within the cstecgi.cgi component of the Totolink A7100RU firmware. A malformed igmpVer parameter can be exploited to inject arbitrary operating system commands, enabling an attacker to execute code with the privileges of the web process. This type of flaw corresponds to CWE-77 (OS Command Injection) and CWE-78 (Command Injection) and can result in full compromise of the device’s operating environment, jeopardizing confidentiality, integrity, and availability of the router and any connected networks.

Affected Systems

Affected systems are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The flaw is exercised through the /cgi-bin/cstecgi.cgi CGI handler that processes IPTV configuration requests.

Risk and Exploitability

The vulnerability is rated at CVSS 9.3, indicating a high severity level. The EPSS score is 14%, and the flaw is not listed in the CISA KEV catalog, though an exploit has been released to the public. The attack vector is remote, reachable from outside the local network, and based on the description, it is inferred that no special authentication is required. Given the public availability of the exploit, the risk of real‑world exploitation is significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify whether Totolink has released an updated firmware that addresses the command injection flaw; if so, update the device immediately.
  • If no patch is available, block remote access to the cstecgi.cgi endpoint or the entire CGI handler using the router’s firewall or access control lists.
  • As an additional precaution, restrict IGMP configuration changes to trusted local administrators and monitor logs for unexpected parameters or command execution patterns.
  • Consider temporarily disabling the IPTV configuration feature if it is not required for business operations.

Generated by OpenCVE AI on October 25, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 9, 2026, 4:15 PM
Reserved
Apr 8, 2026, 7:20 PM

View source JSON

Updated
Apr 9, 2026, 2:28 PM

JSON

Status
Deferred
Published
Apr 9, 2026, 7:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON