Which versions of A7100Ru are affected by EUVD-2026-21272?

Totolink A7100RU routers running firmware 7.4cu.2313_b20191024 are vulnerable to unauthenticated remote command execution via a CGI parameter injection flaw, allowing complete system compromise…

Is there a public PoC exploit available for EUVD-2026-21272?

Yes, a public proof-of-concept exploit is available for EUVD-2026-21272. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate EUVD-2026-21272?

Within 24 hours: Identify and inventory all Totolik A7100RU devices in production, isolate affected units from untrusted networks or disable WAN access until mitigation is confirmed. Within 7 days: Contact Totolik support to obtain firmware updates beyond version 7.4cu.2313_b20191024; if no patch is available, implement network segmentation to restrict CGI handler access (/cgi-bin/cstecgi.cgi) via firewall rules. Within 30 days: Deploy patched firmware to all affected devices once vendor releases a secure build, or evaluate router replacement if vendor support is unavailable; conduct forensic review of access logs to detect prior exploitation.

A7100Ru EUVD-2026-21272

Q: What is the CVSS score of EUVD-2026-21272?

EUVD-2026-21272 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

| CVE-2026-5995 HIGH

OS Command Injection (CWE-78)

2026-04-10 VulDB

Command Injection A7100Ru

8.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

PoC Detected

Apr 10, 2026 - 01:16 vuln.today

Public exploit code

EUVD ID Assigned

Apr 10, 2026 - 01:00 euvd

EUVD-2026-21272

Analysis Generated

Apr 10, 2026 - 01:00 vuln.today

CVE Published

Apr 10, 2026 - 00:45 nvd

HIGH 8.9

DescriptionCVE.org

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os command injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

OS command injection in Totolink A7100RU 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via malicious lan_info parameter to setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector requiring no privileges or user interaction. Publicly available exploit code exists. Complete compromise of confidentiality, integrity, and availability achievable through CGI handler manipulation.

Technical ContextAI

CWE-78 OS command injection in CGI handler's setMiniuiHomeInfoShow function. Insufficient input validation on lan_info parameter enables shell metacharacter injection, allowing direct system command execution in router firmware's CGI processing path at /cgi-bin/cstecgi.cgi without authentication barriers.

RemediationAI

No vendor-released patch identified at time of analysis. Immediately isolate affected Totolink A7100RU devices from untrusted networks. Disable remote administration interfaces and restrict CGI access to trusted management networks only via firewall rules. Monitor vendor advisory page at https://www.totolink.net/ for firmware updates. If device must remain internet-accessible, place behind WAF with strict input validation rules blocking shell metacharacters in lan_info parameter. Consider hardware replacement given exploit availability and lack of confirmed vendor response. Consult VulDB threat intelligence at https://vuldb.com/vuln/356549 and https://vuldb.com/vuln/356549/cti for ongoing threat actor activity monitoring.