CVE-2026-5975
Published: 09 April 2026
Description
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command injection. The attack may be performed…
more
from remote. The exploit is publicly available and might be used.
Mitigating Controls (NIST 800-53 r5)AI
Validating the wanIdx argument in the setDmzCfg CGI function directly prevents OS command injection by rejecting malformed inputs.
Flaw remediation requires patching the vulnerable firmware version 7.4cu.2313_b20191024 to eliminate the command injection vulnerability.
Boundary protection at the router's managed interfaces restricts unauthenticated remote access to the vulnerable /cgi-bin/cstecgi.cgi endpoint.
Security SummaryAI
CVE-2026-5975 is an OS command injection vulnerability in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue affects the setDmzCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the wanIdx argument enables arbitrary command execution. Classified under CWE-77 and CWE-78, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation allows attackers to inject and execute arbitrary operating system commands, potentially achieving high impacts on confidentiality, integrity, and availability, such as full router control, data exfiltration, or further network pivoting.
Advisories and additional details are available through references including VulDB entries (vuln/356529 and submit/791821), a GitHub repository containing the public exploit (Litengzheng/vuldb_new/blob/main/A7100RU/vul_161/README.md), and the vendor site (totolink.net). These sources document the issue but do not specify patches in the provided information.
A publicly available exploit exists, increasing the risk of real-world abuse against unpatched Totolink A7100RU devices.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).