Which versions of A7100Ru are affected by CVE-2026-5996?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution that allows attackers to gain complete control of affected devices without…

Is there a public PoC exploit available for CVE-2026-5996?

Yes, a public proof-of-concept exploit is available for CVE-2026-5996. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5996?

24 hours: Identify and inventory all Totolik A7100RU devices in production; isolate affected devices from critical network segments if feasible; enable access logging on all network perimeter devices. 7 days: Contact Totolik support for patch availability and timeline; evaluate replacement router models from alternative vendors as interim solution; implement network segmentation to limit lateral movement from compromised devices. 30 days: Deploy replacement hardware or apply vendor patch immediately upon release; conduct forensic review of device logs for unauthorized access; verify network integrity and reset all credentials on affected systems.

A7100Ru CVE-2026-5996

Q: What is the CVSS score of CVE-2026-5996?

CVE-2026-5996 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21274 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-cv4h-4m28-8hr9

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 02:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21274

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:00 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tty_server leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server parameter in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity reflects network-accessible exploitation requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can achieve full system compromise including data exfiltration, configuration tampering, and denial of service against affected routers.

Technical ContextAI

CWE-78 command injection in CGI handler fails to sanitize tty_server argument before passing to shell execution context. Unauthenticated network vector (AV:N/PR:N) enables remote exploitation. Proof-of-concept demonstrates direct parameter manipulation to inject shell metacharacters, bypassing input validation in setAdvancedInfoShow function within cstecgi.cgi binary.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories addressing CVE-2026-5996 on their official site (https://www.totolink.net/). Recommended immediate mitigations: (1) disable remote administration interfaces and restrict CGI access to trusted internal networks only via firewall rules; (2) implement network segmentation to isolate affected devices from critical infrastructure; (3) monitor vendor security bulletins at https://www.totolink.net/ for future firmware updates; (4) consider replacing device if vendor support discontinued. Do not expose vulnerable firmware to untrusted networks given publicly available exploit code and unauthenticated attack surface.