CVE-2026-5977

Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection

View on CVE.org
Published Apr 9, 2026 CVSS 4.0 · 9.3 Critical EPSS 2.2% KEV · Not listed
Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability resides in the setWiFiBasicCfg function of the /cgi-bin/cstecgi.cgi CGI handler on Totolink A7100RU firmware 7.4cu.2313_b20191024. The attacker can supply a crafted value for the wifiOff parameter, which is passed directly to an operating‑system command line. This leads to an os command injection that results in remote code execution. The weakness is defined by CWE‑77 and CWE‑78.

Affected Systems

Vendors affected include Totolink. The product impacted is the A7100RU router running firmware version 7.4cu.2313_b20191024. All devices that have not applied the vendor’s firmware update are susceptible.

Risk and Exploitability

The CVSS base score of 9.3 indicates critical severity, and the vulnerability has a known public exploit available. Although the EPSS score is 2%, the presence of a public exploit and the ability to trigger the injection remotely mean that the attack is likely to be attempted. The vulnerability is not currently listed in the CISA KEV catalog, but the risk remains high because it can allow attackers to gain full control over the device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Totolink firmware that addresses the command‑injection vulnerability to the A7100RU router.
  • Restrict remote management access by configuring the router’s firewall or access‑control lists to allow only trusted IP addresses and disable the CGI interface if not needed.
  • Enable robust authentication on the router’s web interface and monitor access logs for repeated attempts to inject commands via the wifiOff parameter.

Generated by OpenCVE AI on October 25, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 2:48 PM
Reserved
Apr 9, 2026, 12:11 PM

View source JSON

Updated
Apr 14, 2026, 2:48 PM

JSON

Status
Deferred
Published
Apr 9, 2026, 9:16 PM
Modified
Oct 26, 2026, 10:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON