Which versions of A7100Ru are affected by CVE-2026-5850?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via the VPN configuration interface, allowing attackers to completely…

Is there a public PoC exploit available for CVE-2026-5850?

Yes, a public proof-of-concept exploit is available for CVE-2026-5850. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5850?

Within 24 hours: Identify and inventory all Totolik A7100RU routers in production; verify firmware version via admin console. Contact Totolink support immediately to confirm firmware update availability and timeline for version 7.4cu.2313_b20191024 and later. Within 7 days: Isolate affected routers from production networks if possible, or restrict WAN access via firewall rules to limit exposure surface. Within 30 days: Deploy confirmed patched firmware version to all affected devices after vendor releases fix; validate through change management before production deployment.

A7100Ru CVE-2026-5850

Q: What is the CVSS score of CVE-2026-5850?

CVE-2026-5850 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-20862 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-2vw5-mf9h-8p68

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 06:15 euvd

EUVD-2026-20862

Analysis Generated

Apr 09, 2026 - 06:15 vuln.today

CVE Published

Apr 09, 2026 - 05:45 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical).

Technical ContextAI

CWE-78 command injection in CGI handler's VPN passthrough configuration function. The pptpPassThru parameter lacks input sanitization, enabling shell metacharacter injection into backend OS commands. Router's embedded Linux processes unsanitized CGI input directly in system calls, granting shell-level code execution through web management interface on TCP port typically 80/443.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing this vulnerability per vendor site review (https://www.totolink.net/). Recommended immediate actions: disable remote management access to CGI interface, restrict administrative access to trusted internal networks only via firewall rules, disable PPTP VPN passthrough functionality if not operationally required. Monitor VulDB tracking page (https://vuldb.com/vuln/356376) and vendor site for future firmware updates. Consider device replacement with actively maintained hardware if vendor does not issue timely patch. Network segmentation should isolate affected devices from critical assets.