EUVD-2026-21184
GHSA-vg62-g8mg-mm6p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in wifiOff parameter
-
ExecutionsetWiFiBasicCfg function executes injected commands
-
ImpactAchieve remote code execution on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending crafted HTTP requests to /cgi-bin/cstecgi.cgi with malicious wifiOff parameter to trigger OS command injection. No authentication or user interaction required. |
| Impact | CVSS 8.9 reflects unauthenticated remote command injection via network-accessible CGI handler with high impact on confidentiality, integrity, and availability. Moderate observed exploitation activity combined with publicly available exploit code creates immediate operational risk for exposed Totolink A7100RU devices. Priority patching required for internet-facing deployments. |
| Exploit ScenarioDerived | Attacker sends crafted HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected into wifiOff parameter. setWiFiBasicCfg function executes unsanitized input, achieving remote code execution with device privileges. No authentication required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. This vulnerability enables complete device compromise with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists. No CISA KEV listing identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Consult Totolink support portal at https://www.totolink.net/ for firmware updates addressing CVE-2026-5977. If no patched firmware is available, immediately disable remote web management access, restrict administrative interface to trusted internal networks only, and implement network segmentation to isolate affected devices. Consider replacing device if vendor discontinues support. Monitor VulDB advisory https://vuldb.com/vuln/356531 and vendor communications for patch release. Given unauthenticated remote exploitation with public POC at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_163/README.md, prioritize mitigation urgently.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler stems from insufficient input sanitization of the wifiOff parameter passed to setWiFiBasicCfg function. CVSS vector PR:N confirms unauthenticated attack surface. The vulnerability resides in the web management interface's CGI processing layer, allowing shell metacharacter injection through HTTP requests to cstecgi.cgi, resulting in arbitrary command execution with firmware process privileges.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
Totolink A7100RU router firmware contains a critical unauthenticated remote command injection vulnerability (CVE-2026-5977, CVSS 8.9) that allows attackers to execute arbitrary commands and fully compromise the device. This affects all users of the A7100RU with firmware version 7.4cu.2313_b20191024 or earlier, exposing organizational networks to immediate unauthorized access, data exfiltration, and lateral movement risks. The absence of a vendor patch creates persistent organizational exposure until remediation is completed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement firewall/WAF rules to block all unauthenticated access to /cgi-bin/cstecgi.cgi; (2) Segment affected devices to isolated VLAN with egress filtering; (3) Disable remote management and web interface access from untrusted networks; (4) Monitor for suspicious process execution on affected devices; (5) Enforce network access controls to limit router administration to authorized personnel only. These controls reduce but do not eliminate risk; device replacement is strongly recommended.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB