Which versions of A7100Ru are affected by EUVD-2026-20868?

Totolink A7100RU router (version 7.4cu.2313_b20191024 and likely earlier) contains an unauthenticated remote command injection vulnerability accessible via the web interface, allowing attackers to…

Is there a public PoC exploit available for EUVD-2026-20868?

Yes, a public proof-of-concept exploit is available for EUVD-2026-20868. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-20868?

Within 24 hours: Identify and inventory all Totolik A7100RU routers in production and isolate them from critical network segments if possible; disable remote management interfaces and restrict access to /cgi-bin/cstecgi.cgi to trusted networks only. Within 7 days: Contact Totolik support to confirm whether patched firmware versions are available for this specific model; if available, plan maintenance window for immediate deployment. Within 30 days: If no patch is released by vendor, evaluate replacement or retirement of affected units; implement network segmentation and intrusion detection rules to detect exploitation attempts against the addrPrefixLen parameter.

A7100Ru EUVD-2026-20868

Q: What is the CVSS score of EUVD-2026-20868?

EUVD-2026-20868 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-5853 HIGH

OS Command Injection (CWE-78)

2026-04-09 VulDB

GHSA-hh2p-hqf4-c9m6

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 09, 2026 - 07:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 07:00 euvd

EUVD-2026-20868

Analysis Generated

Apr 09, 2026 - 07:00 vuln.today

CVE Published

Apr 09, 2026 - 06:30 nvd

HIGH 8.9

DescriptionCVE.org

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument addrPrefixLen leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists.

Technical ContextAI

CWE-78 OS command injection vulnerability originates from insufficient input validation in setIpv6LanCfg CGI function handling IPv6 LAN configuration parameters. The addrPrefixLen argument accepts unsanitized user input, allowing shell metacharacter injection that executes commands under web server privileges. Attack vector exploits CGI handler's direct system call invocation without parameter escaping or whitelisting.

RemediationAI

No vendor-released patch identified at time of analysis. Check Totolink official support page (https://www.totolink.net/) for firmware updates beyond October 2019 build. Immediate mitigations: disable IPv6 configuration interface if not operationally required; restrict administrative access to CGI interface via firewall rules permitting only trusted management networks; implement network segmentation isolating vulnerable devices from untrusted networks. Deploy intrusion detection signatures monitoring for command injection patterns targeting /cgi-bin/cstecgi.cgi endpoint. Given publicly available exploit code (https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_159/README.md) and critical CVSS score, prioritize device replacement if vendor discontinues support for affected firmware branch. Consult VulDB advisory for technical details: https://vuldb.com/vuln/356379