Cyber Posture

CVE-2026-5976

Critical

Published: 09 April 2026

Published
09 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 79.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to…

more

initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates and sanitizes the sambaEnabled argument in the setStorageCfg function to block OS command injection payloads.

SI-2 Flaw Remediation good match
prevent

Remediates the specific command injection flaw in the Totolink A7100RU firmware through timely patching or updates.

IA-8 Identification and Authentication (Non-organizational Users) partial match
prevent

Requires identification and authentication for non-organizational users accessing the vulnerable CGI handler, blocking unauthenticated remote exploitation.

Security SummaryAI

CVE-2026-5976 is an OS command injection vulnerability in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The flaw resides in the setStorageCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where manipulation of the sambaEnabled argument enables arbitrary command execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-77 (Command Injection) and CWE-78 (OS Command Injection).

The vulnerability can be exploited remotely by unauthenticated attackers with network access, requiring low complexity and no user interaction. Successful exploitation grants attackers high-impact access to confidentiality, integrity, and availability, potentially allowing full router compromise, such as executing arbitrary commands on the underlying operating system.

Advisories from VulDB (vuln/356530 and related entries) document the issue and its CTI implications, while a public exploit is available in a GitHub repository (Litengzheng/vuldb_new). The Totolink vendor website provides general support resources, but no specific patch details are outlined in the referenced materials.

Details

CWE(s)
CWE-77CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Unauthenticated remote OS command injection via web CGI on a public-facing router directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References