Which versions of Totolink A7100RU are affected by CVE-2026-5852?

Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that grants attackers complete device control without credentials.

Is there a public PoC exploit available for CVE-2026-5852?

Yes, a public proof-of-concept exploit is available for CVE-2026-5852. Prioritise patching immediately. EPSS: 0.9%.

Totolink A7100RU CVE-2026-5852

Q: What is the CVSS score of CVE-2026-5852?

CVE-2026-5852 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-20866 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-v7g8-5jcv-9p6p

Command Injection

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 07:00 euvd

EUVD-2026-20866

Analysis Generated

Apr 09, 2026 - 07:00 vuln.today

CVE Published

Apr 09, 2026 - 06:15 nvd

HIGH 8.9

DescriptionNVD

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. …

RemediationAI

Within 24 hours: Identify and inventory all Totolink A7100RU devices in your environment; disable WAN-facing administrative access if possible. Within 7 days: Contact Totolink support to confirm firmware availability beyond 7.4cu.2313_b20191024; if available, schedule immediate firmware updates across all affected units following change management procedures. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-5852 vulnerability details – vuln.today

Back

Totolink A7100RU CVE-2026-5852

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

Totolink A7100RU CVE-2026-5852

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code