Which versions of A7100Ru are affected by CVE-2026-5976?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a CGI parameter injection flaw, allowing attackers to achieve complete…

Is there a public PoC exploit available for CVE-2026-5976?

Yes, a public proof-of-concept exploit is available for CVE-2026-5976. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5976?

Within 24 hours: Identify all Totolik A7100RU devices running firmware 7.4cu.2313_b20191024 in your network inventory (check management consoles, network scans, and asset management systems). Within 7 days: Implement network segmentation to isolate affected routers from untrusted networks and restrict access to /cgi-bin/cstecgi.cgi to authorized administrative IPs only via firewall rules. Within 30 days: Contact Totolink support to confirm firmware update availability; if a patched version is released, schedule immediate upgrade testing and deployment; if no patch emerges, evaluate replacement or decommissioning of affected units.

A7100Ru CVE-2026-5976

Q: What is the CVSS score of CVE-2026-5976?

CVE-2026-5976 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21076 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-6vcj-hp8j-m72g

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 20:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 20:15 euvd

EUVD-2026-21076

Analysis Generated

Apr 09, 2026 - 20:15 vuln.today

CVE Published

Apr 09, 2026 - 20:00 nvd

HIGH 8.9

DescriptionCVE.org

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via crafted sambaEnabled parameter in setStorageCfg function of /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists. Network-reachable attack vector requires no user interaction, enabling full system compromise of affected routers.

Technical ContextAI

CWE-78 command injection vulnerability stems from insufficient input validation in CGI handler processing sambaEnabled argument within storage configuration function. Attacker-controlled input passed to setStorageCfg executes directly in shell context without sanitization. CVSS 4.0 vector confirms unauthenticated network attack (PR:N, AV:N) with proof-of-concept exploitation status (E:P).

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-5976 per vendor site (https://www.totolink.net/). Immediate mitigation: disable remote administration interfaces, restrict CGI access to trusted management networks via firewall rules, disable Samba/storage configuration features if not operationally required. Monitor https://www.totolink.net/ and https://vuldb.com/vuln/356530 for vendor updates. Consider replacing device if vendor discontinues support for affected firmware branch. Organizations should isolate affected routers from untrusted networks until patched firmware becomes available.