EUVD-2026-20866
GHSA-v7g8-5jcv-9p6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in igmpVer parameter
-
ExecutionsetIptvCfg function parses malicious input
-
ImpactExecute arbitrary system commands on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit the setIptvCfg function in /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware 7.4cu.2313_b20191024 by manipulating the igmpVer parameter to inject OS commands. No authentication or user interaction required. |
| Impact | CVSS 9.8 reflects unauthenticated network command injection on router admin interface. Elevation factor: remotely exploitable without authentication, affects router core functionality (IGMP configuration), enables full system compromise. Moderate observed exploitation activity. Public exploit availability increases operational risk for unpatched A7100RU devices in production networks. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with crafted igmpVer parameter containing shell metacharacters (e.g., semicolon, backtick, pipe). CGI handler executes parameter unsanitized via system call, granting attacker command execution as router process. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. CVSS 9.8 (Critical). Publicly available exploit code exists. No authentication, network-accessible attack vector with low complexity allows immediate weaponization for botnet recruitment, credential theft, or lateral network movement.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-5852 per vendor website review (https://www.totolink.net/). Immediate mitigation requires disabling external management interface access and restricting CGI endpoint exposure to trusted internal networks only. Implement network-level access controls blocking inbound connections to /cgi-bin/cstecgi.cgi from untrusted sources. Consider device replacement with actively maintained router firmware. Monitor VulDB advisory updates at https://vuldb.com/vuln/356378 and exploit repository https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_158/README.md for vendor response developments. Deploy intrusion detection signatures targeting igmpVer parameter manipulation patterns in HTTP POST requests to affected CGI paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection in CGI handler fails to sanitize igmpVer parameter input before passing to system shell. CVSS vector PR:N confirms zero authentication barriers. Exploitation occurs at network boundary through standard HTTP requests to CGI endpoint, directly invoking OS commands via unvalidated user-controlled strings in IPTV configuration function.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that grants attackers complete device control without credentials. This critical vulnerability exposes organizational network perimeters and home office infrastructure to immediate compromise, enabling attackers to establish persistent footholds for lateral movement, data exfiltration, or use as botnet nodes.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict WAN access to router administrative interfaces via firewall rules; (2) Isolate affected routers to segregated network segments with strict ingress/egress filtering; (3) Monitor router process and network traffic for anomalous command execution; (4) Disable remote management features (SSH, Telnet, HTTP administration) from WAN-facing interfaces; (5) Evaluate device replacement with firmware from vendors with active security patch programs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB