CVE-2026-5677
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A security flaw in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection via the CsteSystem function in /cgi-bin/cstecgi.cgi by manipulating the resetFlags argument. The attack can be performed remotely and the exploit has been publicly released.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the router, leading to full device compromise and potential breach of the local network security.
Recommendation
Immediately update the Totolink A7100RU firmware to the latest version if a patch is available. If no update exists, consider replacing the device with a non-vulnerable model.
Other vulnerabilities in Totolink A7100RU
See all- CVE-2026-5692High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5691High
Vulnerability in Totolink A7100RU router in the setFirewallType function in /cgi-bin/cstecgi.cgi. Manipulation of the firewallType argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5690High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setRemoteCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5689High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setNtpCfg function of /cgi-bin/cstecgi.cgi. Manipulating the tz argument allows remote command execution. A public exploit is available.
- CVE-2026-5688High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Manipulating the provider argument allows remote command execution. A public exploit is available.
- CVE-2026-5678High
Vulnerability in Totolink A7100RU router in the setScheduleCfg function in /cgi-bin/cstecgi.cgi. Manipulation of the mode argument leads to OS command injection. The attack can be carried out remotely.
Original NVD description (English source)
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.