EUVD-2026-21185
GHSA-gpqj-8899-c755
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in mode parameter
-
ExecutionExecute arbitrary commands on router
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit the setWiFiAclRules function in /cgi-bin/cstecgi.cgi on Totolink A7100RU firmware version 7.4cu.2313_b20191024 by injecting OS commands via the mode parameter. No authentication or user interaction required. |
| Impact | High-severity unauthenticated remote command injection in Totolink router CGI handler. CVSS 8.9 reflects complete system compromise (high confidentiality, integrity, availability impact). Network-accessible attack surface, minimal complexity, and public exploit code create immediate risk for unpatched devices. Widely deployed consumer routers amplify blast radius. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected into 'mode' parameter of setWiFiAclRules function. No authentication required. Publicly available exploit code enables rapid weaponization against vulnerable router instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'mode' parameter in the setWiFiAclRules function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists. Attackers can achieve complete device compromise with high impact to confidentiality, integrity, and availability of the router. No authentication required for exploitation (CVSS PR:N).
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories or firmware updates addressing this vulnerability per vendor website (https://www.totolink.net/). Recommended immediate actions: disable remote administration interfaces (web UI, CGI access) from WAN-facing networks; restrict management access to trusted internal IP ranges only via firewall rules; monitor for unauthorized configuration changes in WiFi ACL settings. Consider device replacement if vendor does not release patched firmware within acceptable risk timeframe. Reference exploit details: https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_164/README.md. Vendor contact: https://www.totolink.net/. VulDB advisory: https://vuldb.com/vuln/356532.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler. The setWiFiAclRules function fails to sanitize the 'mode' argument before passing it to shell execution context. Attacker-controlled input is directly interpolated into system calls, enabling arbitrary command execution with router process privileges. Network-accessible CGI endpoint exposes vulnerability without authentication boundary.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 contain a critical unauthenticated remote code execution vulnerability (CVE-2026-5978) that allows attackers to seize complete control of affected devices without credentials. Organizations deploying this router model face immediate risk of network compromise, data interception, and lateral movement into connected systems, with publicly available exploit code accelerating attack likelihood.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict WAN-to-router access via network firewall rules blocking external connectivity to /cgi-bin/cstecgi.cgi; (2) Implement network segmentation isolating router management functions; (3) Deploy intrusion detection signatures for mode parameter exploitation attempts; (4) Monitor router logs for suspicious cgi.cgi access patterns; (5) Disable remote management features if operationally feasible; (6) Consider replacement with patched alternative router model pending vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB