CVE-2026-5852
Published: 09 April 2026
Description
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried…
more
out remotely. The exploit has been made available to the public and could be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the OS command injection flaw in the Totolink A7100RU CGI handler to prevent exploitation of CVE-2026-5852.
Mandates validation of the igmpVer argument in setIptvCfg to detect and reject command injection payloads before execution.
Restricts igmpVer inputs to only valid IGMP version values, blocking arbitrary OS command injection attempts.
Security SummaryAI
CVE-2026-5852 is an OS command injection vulnerability in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue affects the setIptvCfg function within the /cgi-bin/cstecgi.cgi file of the CGI handler component, where manipulation of the igmpVer argument enables arbitrary command execution. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low complexity, and lack of prerequisites.
The vulnerability is remotely exploitable by unauthenticated attackers with network access to the device, requiring no user interaction. Successful exploitation allows attackers to execute arbitrary operating system commands, potentially leading to full compromise of the router with high impacts on confidentiality, integrity, and availability. A public exploit is available, increasing the risk of real-world attacks against exposed devices.
Advisories from VulDB detail the vulnerability and reference a GitHub repository containing an exploit README for the A7100RU. Additional VulDB entries provide submission and CTI context, while the Totolink vendor website is listed, though no specific patches or mitigations are detailed in the available references.
The exploit's public availability heightens the urgency for users of the affected Totolink A7100RU firmware to assess exposure and pursue updates where possible.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable OS command injection in a public-facing router CGI interface (T1190), directly enabling arbitrary Unix shell command execution (T1059.004).