CVE-2026-5995

Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection

View on CVE.org
Published Apr 10, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed
Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The flaw is in the setMiniuiHomeInfoShow handler of the /cgi-bin/cstecgi.cgi script in Totolink A7100RU firmware 7.4cu.2313_b20191024. An attacker who can supply a crafted lan_info argument can inject and execute arbitrary operating‑system commands on the device. This injection permits complete compromise of confidentiality, integrity, and availability by giving the attacker full control over the router and the possibility to extend attacks to the wider network.

Affected Systems

The vulnerability affects Totolink A7100RU models running firmware version 7.4cu.2313_b20191024. Only the CGI handler component is impacted.

Risk and Exploitability

The CVSS score of 9.3 indicates the flaw is critical, and publicly available exploits have already been published. The attack can be launched remotely from the Internet. The EPSS score of 2% indicates a modest but real likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The combination of a high severity score, known public exploits, and remote execution capability means the risk to unpatched devices is high.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s latest firmware update that resolves the cgi command‑injection flaw.
  • If no update is available, block external access to /cgi-bin/cstecgi.cgi or disable CGI services via the router’s firewall or configuration.
  • Restrict the use of the router’s public interface to trusted networks by configuring access control lists or VPN access only.

Generated by OpenCVE AI on October 25, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Totolink a7100ru
Vendors & Products Totolink a7100ru
Type Values Removed Values Added
Description A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
First Time appeared Totolink
Totolink a7100ru Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink a7100ru Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 10, 2026, 12:19 PM
Reserved
Apr 9, 2026, 12:49 PM

View source JSON

Updated
Apr 10, 2026, 12:18 PM

JSON

Status
Deferred
Published
Apr 10, 2026, 1:16 AM
Modified
Oct 26, 2026, 9:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 9:00 PM

JSON