EUVD-2026-21274
GHSA-cv4h-4m28-8hr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in tty_server parameter
-
ExecutionExecute arbitrary command on device
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending a crafted HTTP request with malicious input in the 'tty_server' parameter to /cgi-bin/cstecgi.cgi setAdvancedInfoShow function. No authentication or user interaction required. |
| Impact | Critical unauthenticated remote OS command injection via tty_server parameter in CGI handler. CVSS 9.8 reflects maximum severity (network-exploitable, no authentication required, complete system compromise). Elevated observed exploitation activity and public exploit code materially increase urgency for Totolink A7100RU deployments, particularly in network perimeter roles. |
| Exploit ScenarioDerived | Attacker sends unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command embedded in tty_server parameter. setAdvancedInfoShow function executes injected command with device privileges. Publicly available exploit code exists; no authentication or user interaction required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server parameter in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity reflects network-accessible exploitation requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can achieve full system compromise including data exfiltration, configuration tampering, and denial of service against affected routers.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-5996 on their official site (https://www.totolink.net/). Recommended immediate mitigations: (1) disable remote administration interfaces and restrict CGI access to trusted internal networks only via firewall rules; (2) implement network segmentation to isolate affected devices from critical infrastructure; (3) monitor vendor security bulletins at https://www.totolink.net/ for future firmware updates; (4) consider replacing device if vendor support discontinued. Do not expose vulnerable firmware to untrusted networks given publicly available exploit code and unauthenticated attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection in CGI handler fails to sanitize tty_server argument before passing to shell execution context. Unauthenticated network vector (AV:N/PR:N) enables remote exploitation. Proof-of-concept demonstrates direct parameter manipulation to inject shell metacharacters, bypassing input validation in setAdvancedInfoShow function within cstecgi.cgi binary.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tty_server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution that allows attackers to gain complete control of affected devices without credentials. Organizations using this router model face immediate risk of network compromise, data theft, and service disruption, as the vulnerability is actively exploitable with publicly available tools and no patch currently available from the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to /cgi-bin/cstecgi.cgi via firewall rules; disable remote management interfaces if not operationally required; monitor for suspicious command execution in device logs; implement network segmentation to contain compromised devices; consider device replacement pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection Flaws
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB