Which versions of A7100Ru are affected by CVE-2026-5851?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote code execution via OS command injection, allowing attackers to assume full control of affected…

Is there a public PoC exploit available for CVE-2026-5851?

Yes, a public proof-of-concept exploit is available for CVE-2026-5851. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5851?

Within 24 hours: Identify all Totolik A7100RU devices in production and document firmware versions; isolate affected units (firmware 7.4cu.2313_b20191024) from production networks or place behind restrictive firewall rules blocking access to /cgi-bin/cstecgi.cgi. Within 7 days: Contact Totolink support to confirm patch availability status and timeline; evaluate replacement hardware if patch remains unavailable. Within 30 days: Deploy network segmentation to restrict router administrative access; deploy IDS/IPS signatures blocking exploitation of the 'enable' parameter in setUPnPCfg; migrate to patched firmware or alternative vendor equipment.

A7100Ru CVE-2026-5851

Q: What is the CVSS score of CVE-2026-5851?

CVE-2026-5851 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-20864 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-323c-322q-9h7v

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 06:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 06:15 euvd

EUVD-2026-20864

Analysis Generated

Apr 09, 2026 - 06:15 vuln.today

CVE Published

Apr 09, 2026 - 06:00 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction.

Technical ContextAI

CWE-78 command injection stems from insufficient input sanitization in CGI handler's UPnP configuration routine. Attacker-controlled 'enable' parameter passes unsanitized to system shell execution context. CVSS vector confirms unauthenticated remote attack (PR:N, AV:N, AC:L) with proof-of-concept exploitation capability (E:P).

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigations: (1) Disable UPnP services if not operationally required via router administration interface; (2) Restrict administrative access to trusted internal networks only-block WAN-side access to management interfaces (TCP/80, TCP/443, CGI endpoints) via firewall rules; (3) Replace device with actively maintained alternative if vendor discontinues support; (4) Monitor vendor security advisories at https://www.totolink.net/ for firmware updates addressing CVE-2026-5851. Technical reference and exploit details available at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_157/README.md and https://vuldb.com/vuln/356377. Given publicly available exploit code, prioritize network segmentation isolating affected devices from untrusted networks.