EUVD-2026-21074
GHSA-v89g-prph-7892
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in wanIdx parameter
-
ExecutionsetDmzCfg function processes unsanitized input
-
ImpactExecute arbitrary OS commands on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit CVE-2026-5975 in Totolik A7100RU firmware 7.4cu.2313_b20191024 by sending crafted requests to /cgi-bin/cstecgi.cgi targeting the setDmzCfg function with malicious wanIdx parameter. No authentication or user interaction required. |
| Impact | Unauthenticated remote OS command injection in Totolink router CGI handler with high CVSS (8.9) and elevated observed exploitation activity. Network-accessible attack, low complexity, impacts confidentiality/integrity. Automatable exploitation via publicly available code and CISA assessment of total technical impact make this critical for exposed devices. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command in wanIdx parameter to setDmzCfg function. Command executes with router privileges, enabling remote code execution without authentication. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the wanIdx parameter in the setDmzCfg function within /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with attack complexity low, no privileges required, and no user interaction. Publicly available exploit code exists. Exploitation enables complete compromise of device confidentiality, integrity, and availability with total technical impact.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories for A7100RU firmware post-2019 release per official site review (https://www.totolink.net/). Immediate mitigations: disable remote administration interfaces, restrict CGI access to trusted management networks only via firewall rules, and disable DMZ configuration features if not operationally required. Monitor vendor site https://www.totolink.net/ for firmware updates. Consider device replacement if vendor discontinues support. Vulnerability details: https://vuldb.com/vuln/356529 and proof-of-concept: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_161/README.md
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler's setDmzCfg function. Insufficient input sanitization of wanIdx parameter permits shell metacharacter injection, enabling direct command execution in router's underlying Linux environment. CVSS vector PR:N confirms unauthenticated attack surface via network-accessible CGI interface.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a DMZ configuration parameter, allowing attackers to completely compromise affected devices without user interaction. Organizations relying on this router model for network perimeter defense face immediate risk of unauthorized access, data exfiltration, and lateral network movement. Urgent firmware inventory and remediation is required to prevent active exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement firewall rules blocking external access to port 80/443 on affected routers, restricting DMZ configuration to trusted internal IP ranges only; (2) Disable remote management features and restrict admin access to specific trusted networks; (3) Monitor WAN traffic for POST requests to /cgi-bin/cstecgi.cgi; (4) Consider temporary replacement with patched router models pending vendor firmware release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB