Totolink A7100RU CVE-2026-5690

The vulnerability exists in the CGI handler cstecgi.cgi, a common entry point for remote configuration in Totolink routers. The setRemoteCfg function fails to properly sanitize or validate the enable parameter before passing it to an OS command execution function, resulting in command injection (CWE-77). The affected technology is a web-based router administration interface that processes remote configuration requests without sufficient input filtering. The attack vector is network-based, leveraging the HTTP/HTTPS interface typically exposed on port 80 or 443 of the device, with no authentication required (PR:N in CVSS 4.0 vector). The CGI endpoint does not validate that the enable parameter contains only expected alphanumeric or boolean values, allowing an attacker to inject shell metacharacters such as pipes, semicolons, or command substitution syntax.