Which versions of A7100Ru are affected by EUVD-2026-21268?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that allows attackers to completely compromise the device without credentials…

Is there a public PoC exploit available for EUVD-2026-21268?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21268. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-21268?

Within 24 hours: Inventory all Totolik A7100RU devices on network and isolate any found from production traffic. Within 7 days: Contact Totolink support to confirm firmware update availability beyond 7.4cu.2313_b20191024; if available, test in staging environment and deploy to all affected units. Within 30 days: If no firmware patch is released, evaluate replacement with patched router model or implement network segmentation to restrict administrative access to the affected device and disable any unnecessary exposed services.

A7100Ru EUVD-2026-21268

Q: What is the CVSS score of EUVD-2026-21268?

EUVD-2026-21268 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-5993 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 01:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:00 euvd

EUVD-2026-21268

Analysis Generated

Apr 10, 2026 - 01:00 vuln.today

CVE Published

Apr 10, 2026 - 00:15 nvd

HIGH 8.9

DescriptionCVE.org

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Successful exploitation enables complete device compromise with high impact to confidentiality, integrity, and availability.

Technical ContextAI

CWE-78 OS command injection in CGI handler due to insufficient input validation of wifiOff parameter in setWiFiGuestCfg function. Attack vector is network-accessible (AV:N), requires no privileges (PR:N), and has low complexity (AC:L), enabling trivial exploitation through crafted HTTP requests to CGI endpoint.

RemediationAI

No vendor-released patch identified at time of analysis. Totolink has not published security advisories or updated firmware addressing CVE-2026-5993 per vendor website https://www.totolink.net/. Immediate mitigation: disable remote administration interface, restrict administrative access to trusted internal networks only via firewall rules, disable guest WiFi functionality if not required. Organizations should consider device replacement with actively maintained alternatives due to vendor's inconsistent security update history. Monitor VulDB advisory https://vuldb.com/vuln/356547 and vendor site for future patch availability. Network segmentation to isolate affected devices from critical infrastructure is essential until remediation.