Which versions of A7100Ru are affected by CVE-2026-5977?

Totolink A7100RU router firmware contains a critical unauthenticated remote command injection vulnerability (CVE-2026-5977, CVSS 8.9) that allows attackers to execute arbitrary commands and fully…

Is there a public PoC exploit available for CVE-2026-5977?

Yes, a public proof-of-concept exploit is available for CVE-2026-5977. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5977?

Within 24 hours: Identify and inventory all Totolik A7100RU devices on the network, retrieve current firmware versions via device admin interface, and isolate any running firmware 7.4cu.2313_b20191024 or earlier to a separate VLAN with restricted network access. Within 7 days: Contact Totolink support to confirm patch availability status and timelines; if no patch is available, implement network-level controls to block unauthenticated access to /cgi-bin/cstecgi.cgi via WAF or firewall rules, and disable WiFi configuration features via administrative lockdown if operationally feasible. Within 30 days: Execute migration plan to replace A7100RU units with alternative vendor equipment that has active firmware support, or establish permanent compensating controls if replacement is not immediately possible.

A7100Ru CVE-2026-5977

Q: What is the CVSS score of CVE-2026-5977?

CVE-2026-5977 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21184 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-vg62-g8mg-mm6p

Command Injection TOTOLINK A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 21:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 21:00 euvd

EUVD-2026-21184

Analysis Generated

Apr 09, 2026 - 21:00 vuln.today

CVE Published

Apr 09, 2026 - 20:15 nvd

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Remote OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. This vulnerability enables complete device compromise with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists. No CISA KEV listing identified at time of analysis.

Technical ContextAI

CWE-78 OS command injection in CGI handler stems from insufficient input sanitization of the wifiOff parameter passed to setWiFiBasicCfg function. CVSS vector PR:N confirms unauthenticated attack surface. The vulnerability resides in the web management interface's CGI processing layer, allowing shell metacharacter injection through HTTP requests to cstecgi.cgi, resulting in arbitrary command execution with firmware process privileges.

RemediationAI

No vendor-released patch identified at time of analysis. Consult Totolink support portal at https://www.totolink.net/ for firmware updates addressing CVE-2026-5977. If no patched firmware is available, immediately disable remote web management access, restrict administrative interface to trusted internal networks only, and implement network segmentation to isolate affected devices. Consider replacing device if vendor discontinues support. Monitor VulDB advisory https://vuldb.com/vuln/356531 and vendor communications for patch release. Given unauthenticated remote exploitation with public POC at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_163/README.md, prioritize mitigation urgently.