EUVD-2026-21076
GHSA-6vcj-hp8j-m72g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in sambaEnabled parameter
-
ImpactExecute arbitrary commands with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU router firmware version 7.4cu.2313_b20191024 by sending crafted requests to /cgi-bin/cstecgi.cgi with manipulated sambaEnabled parameter. No authentication or user interaction required. Affects default router configurations. |
| Impact | Critical unauthenticated remote code execution via OS command injection in router CGI handler. CVSS 8.9 reflects high impact (confidentiality, integrity, availability) with network accessibility and low complexity. Publicly available exploit code and confirmed exploitation significantly elevate priority for exposed Totolink A7100RU instances. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command embedded in sambaEnabled parameter. Router executes injected command with elevated privileges, granting full system compromise. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via crafted sambaEnabled parameter in setStorageCfg function of /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists. Network-reachable attack vector requires no user interaction, enabling full system compromise of affected routers.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-5976 per vendor site (https://www.totolink.net/). Immediate mitigation: disable remote administration interfaces, restrict CGI access to trusted management networks via firewall rules, disable Samba/storage configuration features if not operationally required. Monitor https://www.totolink.net/ and https://vuldb.com/vuln/356530 for vendor updates. Consider replacing device if vendor discontinues support for affected firmware branch. Organizations should isolate affected routers from untrusted networks until patched firmware becomes available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection vulnerability stems from insufficient input validation in CGI handler processing sambaEnabled argument within storage configuration function. Attacker-controlled input passed to setStorageCfg executes directly in shell context without sanitization. CVSS 4.0 vector confirms unauthenticated network attack (PR:N, AV:N) with proof-of-concept exploitation status (E:P).
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a CGI parameter injection flaw, allowing attackers to achieve complete system compromise without credentials. This vulnerability poses immediate risk to any organization using these devices for network access or edge security, as exploitation requires only network reachability and no user interaction. Publicly available exploit code elevates threat severity and deployment timeline.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to affected routers via firewall rules-block inbound CGI handler access from untrusted networks; (2) Disable the setStorageCfg function or storage configuration features if not operationally required; (3) Implement network segmentation so routers are isolated from critical systems; (4) Monitor logs and network traffic for suspicious /cgi-bin/cstecgi.cgi requests with 'sambaEnabled' parameters; (5) Evaluate vendor communications and security advisories for emergency firmware patches or workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB