Which versions of A7100Ru are affected by CVE-2026-5997?

CVE-2026-5997 is a critical unauthenticated remote code execution vulnerability affecting Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 and potentially earlier versions.

Is there a public PoC exploit available for CVE-2026-5997?

Yes, a public proof-of-concept exploit is available for CVE-2026-5997. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-5997?

Within 24 hours: Identify all Totolik A7100RU routers on the network using asset inventory tools and network scanning; isolate affected devices from production networks if possible. Within 7 days: Contact Totolik support to obtain available firmware updates (versions after 7.4cu.2313_b20191024); implement network segmentation to restrict access to the router's management interface (/cgi-bin/cstecgi.cgi) to trusted administrative networks only. Within 30 days: Upgrade all identified routers to the latest available firmware version; implement intrusion detection signatures to monitor for CVE-2026-5997 exploitation attempts targeting the admpass parameter; conduct network audit for unauthorized access or lateral movement.

A7100Ru CVE-2026-5997

Q: What is the CVSS score of CVE-2026-5997?

CVE-2026-5997 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-21276 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

GHSA-p28x-g9gq-g347

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 02:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21276

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:15 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the admpass parameter in setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi. Network-accessible with no user interaction required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP request to /cgi-bin/cstecgi.cgi

Exploit

Inject OS commands in admpass parameter

Execution

Execute arbitrary commands with router privileges

Impact

Achieve complete system compromise