Cyber Posture

CVE-2026-5854

Critical

Published: 09 April 2026

Published
09 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 55.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible…

more

to initiate the attack remotely. The exploit is now public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2026-5854 by requiring timely identification, reporting, and correction of the OS command injection flaw in the Totolink router firmware.

SI-10 Information Input Validation good match
prevent

Prevents exploitation of the vulnerability by implementing input validation mechanisms on the 'merge' argument in the setWiFiEasyCfg CGI function to block command injection.

RA-5 Vulnerability Monitoring and Scanning good match
prevent

Enables proactive discovery and remediation of the command injection vulnerability through regular vulnerability scanning of the affected router firmware.

Security SummaryAI

CVE-2026-5854 is an OS command injection vulnerability (CWE-77, CWE-78) in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue affects the setWiFiEasyCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the "merge" argument enables arbitrary command execution.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, no privileges, and no user interaction required. Attackers can send crafted requests to the affected endpoint, achieving high-impact confidentiality, integrity, and availability compromises, such as full router compromise.

Advisories and details are documented on VulDB (vuln/356380 and related pages), with a public exploit available in a GitHub repository at Litengzheng/vuldb_new/blob/main/A7100RU/vul_160/README.md. Security practitioners should check the vendor site at totolink.net for any firmware updates or mitigation guidance.

The exploit is public and may be used, increasing the risk of active exploitation against unpatched Totolink A7100RU devices.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing web application (T1190) leading to OS command injection on a likely Linux-based router (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References