EUVD-2026-21268Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS command in wifiOff parameter
-
ExecutionExecute arbitrary command as root
-
ImpactCompromise router functionality
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit CVE-2026-5993 against Totolik A7100RU firmware version 7.4cu.2313_b20191024 by sending a crafted request to /cgi-bin/cstecgi.cgi with malicious input in the wifiOff parameter of the setWiFiGuestCfg function. No authentication, user interaction, or special configuration required. |
| Impact | Critical severity justified by unauthenticated network-accessible remote code execution with no user interaction required. CVSS 9.8 reflects maximum impact (confidentiality, integrity, availability). Publicly available exploit code substantially elevates risk. Totolink router compromise enables full device control, lateral network movement, and persistent presence. |
| Exploit ScenarioDerived | Attacker sends crafted HTTP request to /cgi-bin/cstecgi.cgi with malicious OS command injected via wifiOff parameter in setWiFiGuestCfg function. No authentication required. Command executes with device privileges, achieving unauthenticated RCE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Successful exploitation enables complete device compromise with high impact to confidentiality, integrity, and availability.
RemediationAI
No vendor-released patch identified at time of analysis. Totolink has not published security advisories or updated firmware addressing CVE-2026-5993 per vendor website https://www.totolink.net/. Immediate mitigation: disable remote administration interface, restrict administrative access to trusted internal networks only via firewall rules, disable guest WiFi functionality if not required. Organizations should consider device replacement with actively maintained alternatives due to vendor's inconsistent security update history. Monitor VulDB advisory https://vuldb.com/vuln/356547 and vendor site for future patch availability. Network segmentation to isolate affected devices from critical infrastructure is essential until remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 OS command injection in CGI handler due to insufficient input validation of wifiOff parameter in setWiFiGuestCfg function. Attack vector is network-accessible (AV:N), requires no privileges (PR:N), and has low complexity (AC:L), enabling trivial exploitation through crafted HTTP requests to CGI endpoint.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Executive ViewAI
Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command injection that allows attackers to completely compromise the device without credentials or user interaction. Organizations deploying this router model face immediate risk of network perimeter breach, lateral movement, and data exfiltration, as attackers can gain full OS-level control.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to /cgi-bin/cstecgi.cgi via firewall rules limiting to trusted administrators only; disable remote management functions if supported by firmware; segment router from critical infrastructure; monitor for suspicious command execution patterns via device logs; consider temporary replacement pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection Flaws
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB