Description
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-04-09
Score: 9.3 Critical
EPSS: 1.2% Low
KEV: No
Impact: Remote code execution via OS command injection
Action: Immediate Patch
AI Analysis

Impact

A security flaw in the Totolink A7100RU router allows an attacker to inject operating system commands through the setWiFiAclRules parameter in the /cgi-bin/cstecgi.cgi interface. The vulnerability is a classic OS command injection (CWE‑77 and CWE‑78) and can be leveraged remotely, giving full control over the device’s operating system and compromising confidentiality, integrity, and availability.

Affected Systems

Devices affected are Totolink A7100RU routers running firmware version 7.4cu.2313_b20191024. The flaw resides in the CGI Handler component within the router’s system firmware.

Risk and Exploitability

The flaw carries a CVSS score of 9.3, indicating a critical impact. Although no EPSS score is available, the vulnerability has been publicly disclosed and exploited, and it is not listed in the CISA KEV catalog yet. Attackers can exploit the flaw remotely by sending a crafted mode parameter to the cstecgi.cgi endpoint, leading to arbitrary command execution on the router.

Generated by OpenCVE AI on April 9, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to a version that resolves the command injection issue.
  • If a firmware update is not immediately available, block or restrict remote access to the /cgi-bin/cstecgi.cgi endpoint through firewall or access‑control rules.
  • As a temporary workaround, ensure that the mode parameter is validated, trimmed, or removed from remote requests by applying custom router configuration or using a network device to filter the specific URL.

Generated by OpenCVE AI on April 9, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru

Thu, 09 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Title Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A7100ru A7100ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-14T16:34:03.036Z

Reserved: 2026-04-09T12:11:50.100Z

Link: CVE-2026-5978

cve-icon Vulnrichment

Updated: 2026-04-14T15:16:10.941Z

cve-icon NVD

Status : Deferred

Published: 2026-04-09T21:16:13.727

Modified: 2026-04-27T19:05:57.310

Link: CVE-2026-5978

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:29:18Z

Weaknesses