Which versions of A7100Ru are affected by CVE-2026-5978?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical unauthenticated remote code execution vulnerability (CVE-2026-5978) that allows attackers to seize complete control…

Is there a public PoC exploit available for CVE-2026-5978?

Yes, a public proof-of-concept exploit is available for CVE-2026-5978. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5978?

Within 24 hours: Identify all Totolik A7100RU routers in production via asset inventory and network scans; isolate or restrict WAN access to affected devices pending remediation. Within 7 days: Contact Totolik support for firmware patch availability and test any released updates in non-production environment; if no patch forthcoming, implement network segmentation to limit router exposure and deploy compensating controls (see below). Within 30 days: Deploy patched firmware to all affected routers or replace with alternative vendor equipment if patch is not released; validate remediation across all instances.

A7100Ru CVE-2026-5978

Q: What is the CVSS score of CVE-2026-5978?

CVE-2026-5978 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21185 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-gpqj-8899-c755

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 21:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 21:00 euvd

EUVD-2026-21185

Analysis Generated

Apr 09, 2026 - 21:00 vuln.today

CVE Published

Apr 09, 2026 - 20:30 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'mode' parameter in the setWiFiAclRules function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists. Attackers can achieve complete device compromise with high impact to confidentiality, integrity, and availability of the router. No authentication required for exploitation (CVSS PR:N).

Technical ContextAI

CWE-78 OS command injection in CGI handler. The setWiFiAclRules function fails to sanitize the 'mode' argument before passing it to shell execution context. Attacker-controlled input is directly interpolated into system calls, enabling arbitrary command execution with router process privileges. Network-accessible CGI endpoint exposes vulnerability without authentication boundary.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories or firmware updates addressing this vulnerability per vendor website (https://www.totolink.net/). Recommended immediate actions: disable remote administration interfaces (web UI, CGI access) from WAN-facing networks; restrict management access to trusted internal IP ranges only via firewall rules; monitor for unauthorized configuration changes in WiFi ACL settings. Consider device replacement if vendor does not release patched firmware within acceptable risk timeframe. Reference exploit details: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_164/README.md. Vendor contact: https://www.totolink.net/. VulDB advisory: https://vuldb.com/vuln/356532.