Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-04-10
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote OS command injection
Action: Immediate Patch
AI Analysis

Impact

The flaw is in the setMiniuiHomeInfoShow handler of the /cgi-bin/cstecgi.cgi script in Totolink A7100RU firmware 7.4cu.2313_b20191024. An attacker who can supply a crafted lan_info argument can inject and execute arbitrary operating‑system commands on the device. This injection permits complete compromise of confidentiality, integrity, and availability by giving the attacker full control over the router and the possibility to extend attacks to the wider network.

Affected Systems

The vulnerability affects Totolink A7100RU models running firmware version 7.4cu.2313_b20191024. Only the CGI handler component is impacted.

Risk and Exploitability

The CVSS score of 9.3 indicates the flaw is critical, and publicly available exploits have already been published. The attack can be launched remotely from the Internet. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The combination of a high severity score, known public exploits, and remote execution capability means the risk to unpatched devices is high.

Generated by OpenCVE AI on April 10, 2026 at 02:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s latest firmware update that resolves the cgi command‑injection flaw.
  • If no update is available, block external access to /cgi-bin/cstecgi.cgi or disable CGI services via the router’s firewall or configuration.
  • Confirm the patch or mitigation by testing the lan_info parameter for command injection reflex.

Generated by OpenCVE AI on April 10, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru

Fri, 10 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A7100ru A7100ru Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-10T12:19:00.502Z

Reserved: 2026-04-09T12:49:14.388Z

Link: CVE-2026-5995

cve-icon Vulnrichment

Updated: 2026-04-10T12:18:56.055Z

cve-icon NVD

Status : Received

Published: 2026-04-10T01:16:42.490

Modified: 2026-04-10T01:16:42.490

Link: CVE-2026-5995

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:27:18Z

Weaknesses