EUVD-2026-21276
GHSA-p28x-g9gq-g347
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /cgi-bin/cstecgi.cgi
-
ExploitInject OS commands in admpass parameter
-
ExecutionExecute arbitrary commands with router privileges
-
ImpactAchieve complete system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires remote access to Totolik A7100RU router running firmware 7.4cu.2313_b20191024. Attacker must access the /cgi-bin/cstecgi.cgi endpoint and inject OS commands via the admpass parameter in the setLoginPasswordCfg function. No authentication or user interaction required. |
| Impact | Critical severity (CVSS 9.8) unauthenticated network OS command injection in Totolink router firmware. Remote attacker can execute arbitrary commands via admpass parameter without authentication or user interaction. Publicly available exploit code significantly reduces barriers to exploitation. Widespread impact on confidentiality, integrity, and availability. |
| Exploit ScenarioDerived | Attacker sends HTTP request to /cgi-bin/cstecgi.cgi with crafted admpass parameter containing OS command injection payload (e.g., bash commands). setLoginPasswordCfg function processes unsanitized input and executes injected commands with device privileges. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the admpass parameter in setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi. Network-accessible with no user interaction required. Publicly available exploit code exists. CVSS 9.8 critical severity reflects complete system compromise potential.
RemediationAI
No vendor-released patch identified at time of analysis. Check Totolink official support portal (https://www.totolink.net/) for firmware updates beyond 7.4cu.2313_b20191024. Immediate mitigations: disable remote administration interfaces, restrict CGI access to trusted internal networks via firewall ACLs, deploy network-based intrusion prevention to block POST requests containing shell metacharacters to /cgi-bin/cstecgi.cgi. If device cannot be patched or isolated, consider hardware replacement with actively maintained alternative. Monitor vendor security advisories and VulDB report https://vuldb.com/vuln/356551 for patch release notifications.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection stems from insufficient input validation in CGI handler's password configuration routine. The admpass parameter accepts attacker-controlled metacharacters passed directly to shell execution context without sanitization, enabling arbitrary command chaining. Network vector (AV:N) with no authentication requirement (PR:N) exposes administrative password-setting interface to pre-auth exploitation.
Know when A7100Ru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Executive ViewAI
CVE-2026-5997 is a critical unauthenticated remote code execution vulnerability affecting Totolik A7100RU routers running firmware 7.4cu.2313_b20191024 and potentially earlier versions. An attacker can execute arbitrary system commands on the router without authentication, achieving complete device compromise and potential lateral movement into the network. Organizations using this router model require immediate action to prevent unauthorized access and network infiltration.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-level access controls to restrict external connectivity to the router's web interface on port 80/443; (2) Deploy Web Application Firewall (WAF) rules to filter requests containing suspicious admpass parameter payloads; (3) Monitor router logs for unusual activity on /cgi-bin/cstecgi.cgi; (4) Disable remote management access if operationally feasible; (5) Segment router management access to dedicated administrative networks only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in Totolink A7100RU Command Injection Flaws
View all 5Command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to ex
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313 allows unauthenticated remote attackers to execute a
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execut
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote atta
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote at
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to
Exploit-DB