Which versions of A7100Ru are affected by CVE-2026-5692?

CVE-2026-5692 is a critical unauthenticated remote code execution vulnerability affecting Totolik A7100RU routers running firmware 7.4cu.2313_b20191024, allowing attackers to execute arbitrary…

Is there a public PoC exploit available for CVE-2026-5692?

Yes, a public proof-of-concept exploit is available for CVE-2026-5692. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-5692?

Within 24 hours: Identify all Totolik A7100RU devices running firmware 7.4cu.2313_b20191024 in your environment and isolate them from production networks if possible; check Totolik's official website for available firmware updates and apply the latest version. Within 7 days: Implement network-based access controls to restrict remote access to the affected router's web interface (/cgi-bin/cstecgi.cgi) to trusted administrative networks only; enable logging and monitor for suspicious activity to the 'enable' parameter. Within 30 days: Replace the affected router hardware with an alternative vendor solution, or upgrade to a confirmed patched firmware version once Totolik releases one; document all affected devices and remediation actions taken.

A7100Ru CVE-2026-5692

Q: What is the CVSS score of CVE-2026-5692?

CVE-2026-5692 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-19557 MEDIUM

OS Command Injection (CWE-78)

2026-04-06 VulDB

Command Injection A7100Ru

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 23:31 euvd

EUVD-2026-19557

Analysis Generated

Apr 06, 2026 - 23:31 vuln.today

CVE Published

Apr 06, 2026 - 23:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists on GitHub (EPSS and KEV status not provided, but publicly available proof-of-concept increases immediate risk). Attack vector is network-based with low complexity requiring no user interaction or authentication (CVSS:3.1 AV:N/AC:L/PR:N/UI:N).

Technical ContextAI

This vulnerability affects the Totolink A7100RU router (CPE: cpe:2.3:a:totolink:a7100ru), specifically firmware version 7.4cu.2313_b20191024 released October 2019. The flaw resides in the web administration interface's CGI handler at /cgi-bin/cstecgi.cgi, within the setGameSpeedCfg function likely intended for gaming traffic optimization features. The root cause is CWE-78 (OS Command Injection), where user-controlled input from the 'enable' parameter is passed to system shell commands without proper sanitization or validation. This classic injection vulnerability allows attackers to break out of the intended command context and execute arbitrary operating system commands with the privileges of the web server process, typically running as root on embedded router devices. The CGI interface's direct exposure to the network combined with lack of input validation creates a straightforward attack surface.

RemediationAI

No vendor-released patch identified at time of analysis based on available references (CVSS temporal vector RL:X indicates unavailable remediation). Users should immediately check the Totolink support website at https://www.totolink.net/ for firmware updates newer than version 7.4cu.2313_b20191024 and apply them if available. As interim mitigations, disable remote administration access to the router's web interface, restrict management access to trusted internal IP addresses only through firewall rules if the router supports this feature, and place the device behind a separate firewall that blocks external access to ports 80 and 443 destined for the router's LAN IP. Consider replacing the device with alternative hardware if Totolink does not release security updates, as command injection vulnerabilities in embedded devices are often terminal security issues without vendor patches. Monitor VulDB references (https://vuldb.com/vuln/355519) and the vendor site for updated remediation guidance.