Which versions of A7100Ru are affected by CVE-2026-5975?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a DMZ configuration parameter, allowing attackers to completely…

Is there a public PoC exploit available for CVE-2026-5975?

Yes, a public proof-of-concept exploit is available for CVE-2026-5975. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5975?

Within 24 hours: Identify all Totolik A7100RU devices in production and isolate from critical network paths; check Totolink vendor advisory for available firmware versions beyond 7.4cu.2313_b20191024. Within 7 days: Contact Totolink support for patch status and interim firmware alternatives; implement network-level controls restricting WAN-facing access to DMZ configuration interface (/cgi-bin/cstecgi.cgi). Within 30 days: Deploy updated firmware immediately upon vendor release or plan replacement if no patch is issued; audit logs for exploitation attempts (POST requests to setDmzCfg with wanIdx parameter variations).

A7100Ru CVE-2026-5975

Q: What is the CVSS score of CVE-2026-5975?

CVE-2026-5975 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21074 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-v89g-prph-7892

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 20:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 20:15 euvd

EUVD-2026-21074

Analysis Generated

Apr 09, 2026 - 20:15 vuln.today

CVE Published

Apr 09, 2026 - 19:45 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the wanIdx parameter in the setDmzCfg function within /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with attack complexity low, no privileges required, and no user interaction. Publicly available exploit code exists. Exploitation enables complete compromise of device confidentiality, integrity, and availability with total technical impact.

Technical ContextAI

CWE-78 OS command injection in CGI handler's setDmzCfg function. Insufficient input sanitization of wanIdx parameter permits shell metacharacter injection, enabling direct command execution in router's underlying Linux environment. CVSS vector PR:N confirms unauthenticated attack surface via network-accessible CGI interface.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories for A7100RU firmware post-2019 release per official site review (https://www.totolink.net/). Immediate mitigations: disable remote administration interfaces, restrict CGI access to trusted management networks only via firewall rules, and disable DMZ configuration features if not operationally required. Monitor vendor site https://www.totolink.net/ for firmware updates. Consider device replacement if vendor discontinues support. Vulnerability details: https://vuldb.com/vuln/356529 and proof-of-concept: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_161/README.md