Which versions of A7100Ru are affected by CVE-2026-5854?

Totolik A7100RU routers (version 7.4cu.2313_b20191024 and potentially earlier) contain a critical unauthenticated remote command injection vulnerability that allows attackers to execute arbitrary…

Is there a public PoC exploit available for CVE-2026-5854?

Yes, a public proof-of-concept exploit is available for CVE-2026-5854. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-5854?

Within 24 hours: Identify all Totolik A7100RU routers in production using network scanning or device inventory tools and isolate affected devices to an out-of-band management network if possible. Within 7 days: Contact Totolik support for firmware availability beyond version 7.4cu.2313_b20191024; if no patch is released, implement network-level mitigation (see compensating_controls). Within 30 days: Develop a device replacement or decommissioning plan; evaluate migration to a patched router model with active vendor support and security maintenance.

A7100Ru CVE-2026-5854

Q: What is the CVSS score of CVE-2026-5854?

CVE-2026-5854 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-20870 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 07:00 euvd

EUVD-2026-20870

Analysis Generated

Apr 09, 2026 - 07:00 vuln.today

CVE Published

Apr 09, 2026 - 06:45 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'merge' parameter in setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity. Publicly available exploit code exists. Attack requires no authentication or user interaction, enabling complete system compromise including data exfiltration, configuration tampering, and denial of service.

Technical ContextAI

CWE-78 OS command injection in CGI handler due to insufficient input sanitization of 'merge' argument in setWiFiEasyCfg function. Network-accessible endpoint accepts attacker-controlled input directly into shell execution context. CVSS vector AV:N/AC:L/PR:N indicates trivial remote exploitation without credential requirements. Public proof-of-concept demonstrates injection methodology against /cgi-bin/cstecgi.cgi.

RemediationAI

No vendor-released patch identified at time of analysis. Check Totolink support portal (https://www.totolink.net/) for updated firmware releases addressing CVE-2026-5854. Until patched firmware becomes available, implement network-layer mitigations: restrict administrative interface access to trusted management networks only via firewall rules, disable remote administration features if not operationally required, deploy intrusion prevention signatures targeting /cgi-bin/cstecgi.cgi command injection patterns. Consider hardware replacement if vendor discontinues security support. Monitor VulDB advisory https://vuldb.com/vuln/356380 for vendor response updates. Exploitation proof-of-concept at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_160/README.md demonstrates attack vectors to validate protective control effectiveness.