EUVD-2026-20870Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command via merge parameter
-
ExecutionExecute arbitrary command as root
-
ImpactCompromise device functionality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit the setWiFiEasyCfg function in /cgi-bin/cstecgi.cgi on Totolik A7100RU firmware version 7.4cu.2313_b20191024 by manipulating the 'merge' argument to inject OS commands. No authentication or user interaction required. |
| Impact | Critical unauthenticated remote code execution via OS command injection in CGI handler. CVSS 9.8 reflects maximum severity: network-accessible, no authentication required, trivial exploitation complexity. Elevated observed exploitation activity. Public exploit code and router's widespread deployment create substantial blast radius for unskilled attackers targeting default configurations. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with crafted 'merge' parameter containing shell metacharacters (e.g., semicolon or backtick). Publicly available exploit code exists; router executes injected OS commands with CGI process privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'merge' parameter in setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity. Publicly available exploit code exists. Attack requires no authentication or user interaction, enabling complete system compromise including data exfiltration, configuration tampering, and denial of service.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink support portal (https://www.totolink.net/) for updated firmware releases addressing CVE-2026-5854. Until patched firmware becomes available, implement network-layer mitigations: restrict administrative interface access to trusted management networks only via firewall rules, disable remote administration features if not operationally required, deploy intrusion prevention signatures targeting /cgi-bin/cstecgi.cgi command injection patterns. Consider hardware replacement if vendor discontinues security support. Monitor VulDB advisory https://vuldb.com/vuln/356380 for vendor response updates. Exploitation proof-of-concept at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_160/README.md demonstrates attack vectors to validate protective control effectiveness.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler due to insufficient input sanitization of 'merge' argument in setWiFiEasyCfg function. Network-accessible endpoint accepts attacker-controlled input directly into shell execution context. CVSS vector AV:N/AC:L/PR:N indicates trivial remote exploitation without credential requirements. Public proof-of-concept demonstrates injection methodology against /cgi-bin/cstecgi.cgi.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Executive ViewAI
Totolik A7100RU routers (version 7.4cu.2313_b20191024 and potentially earlier) contain a critical unauthenticated remote command injection vulnerability that allows attackers to execute arbitrary commands with full system privileges. This directly threatens network perimeter security, as compromised routers can serve as entry points for lateral network attacks, data exfiltration, and persistent backdoor installation. Organizations operating this router model face immediate risk of network takeover without any required user action or credentials.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to router management interface (/cgi-bin/cstecgi.cgi) via firewall rules, allowing only trusted administrative IPs; (2) Disable remote management access to the router; (3) Segment the router on a separate VLAN with strict egress filtering; (4) Monitor router logs and network traffic for suspicious setWiFiEasyCfg requests or unexpected outbound connections; (5) Implement network intrusion detection/prevention signatures for CVE-2026-5854 exploitation attempts. These controls reduce but do not eliminate risk-device replacement is strongly recommended.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB