CVE-2026-5993

Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection

View on CVE.org
Published Apr 10, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Description
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Analysis

AI-generated

Technical impact

A flaw in the setWiFiGuestCfg function of the /cgi-bin/cstecgi.cgi CGI handler permits an attacker to inject operating‑system commands via the wifiOff argument. This OS command injection can lead to execution of arbitrary commands on the router, effectively providing the attacker with remote code execution capabilities. The vulnerability is associated with CWE-77 and CWE-78 and a publicly available exploit exists.

Affected Systems

The vulnerability affects Totolink A7100RU routers running firmware 7.4cu.2313_b20191024. Any device of this model with the specified firmware version is vulnerable.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity, and the attack is remote, allowing exploitation over the network. An exploit is publicly posted, increasing the likelihood of real‑world attacks. The EPSS score is 2% and the vulnerability is not listed in CISA's KEV catalog, but the combination of high CVSS, public exploit availability, and remote nature results in a high risk that demands prompt remediation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update from Totolink that addresses the CGI handler vulnerability.
  • If a patch is not immediately available, disable or block access to the /cgi-bin/cstecgi.cgi endpoint or the guest WiFi configuration interface via router settings or network ACLs.
  • Restrict remote administration to trusted IP addresses or networks to reduce the attack surface.

Generated by OpenCVE AI on October 25, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Title Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 14, 2026, 4:33 PM
Reserved
Apr 9, 2026, 12:49 PM

View source JSON

Updated
Apr 14, 2026, 3:17 PM

JSON

Status
Deferred
Published
Apr 10, 2026, 1:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON