Which versions of Totolink A7100RU are affected by CVE-2026-5993?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that allows attackers to completely compromise the device without credentials…

Is there a public PoC exploit available for CVE-2026-5993?

Yes, a public proof-of-concept exploit is available for CVE-2026-5993. Prioritise patching immediately. EPSS: 0.9%.

Totolink A7100RU CVE-2026-5993

Q: What is the CVSS score of CVE-2026-5993?

CVE-2026-5993 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21268 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

Command Injection

8.9

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 01:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:00 euvd

EUVD-2026-21268

Analysis Generated

Apr 10, 2026 - 01:00 vuln.today

CVE Published

Apr 10, 2026 - 00:15 nvd

HIGH 8.9

DescriptionNVD

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. …

RemediationAI

Within 24 hours: Inventory all Totolik A7100RU devices on network and isolate any found from production traffic. Within 7 days: Contact Totolink support to confirm firmware update availability beyond 7.4cu.2313_b20191024; if available, test in staging environment and deploy to all affected units. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-5993 vulnerability details – vuln.today

Back

Totolink A7100RU CVE-2026-5993

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

Totolink A7100RU CVE-2026-5993

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code