How to fix CVE-2026-5850?

Within 24 hours: Identify and inventory all Totolik A7100RU routers in production; verify firmware version via admin console. Contact Totolink support immediately to confirm firmware update availability and timeline for version 7.4cu.2313_b20191024 and later. Within 7 days: Isolate affected routers from production networks if possible, or restrict WAN access via firewall rules to limit exposure surface. Within 30 days: Deploy confirmed patched firmware version to all affected devices after vendor releases fix; validate through change management before production deployment.

Is Command Injection affected by CVE-2026-5850?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via the VPN configuration interface, allowing attackers to completely compromise affected devices without credentials or user interaction.

CVE-2026-5850

EUVD-2026-20862 HIGH

2026-04-09 VulDB

GHSA-2vw5-mf9h-8p68

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

Analysis Generated

Apr 09, 2026 - 06:15 vuln.today

EUVD ID Assigned

Apr 09, 2026 - 06:15 euvd

EUVD-2026-20862

CVE Published

Apr 09, 2026 - 05:45 nvd

HIGH 8.9

Description

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Analysis

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). …

Remediation

Within 24 hours: Identify and inventory all Totolik A7100RU routers in production; verify firmware version via admin console. Contact Totolink support immediately to confirm firmware update availability and timeline for version 7.4cu.2313_b20191024 and later. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.9

CVSS: +44

POC: +20

CVE-2026-5850 vulnerability details – vuln.today

Back

CVE-2026-5850

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-5850

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code