CVE-2026-5688
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Manipulating the provider argument allows remote command execution. A public exploit is available.
Risk Assessment
A remote, unauthenticated attacker could take full control of the router, potentially compromising network security and intercepting traffic.
Recommendation
Immediately update the Totolink A7100RU firmware to the latest version if available, or consider replacing the device with a supported model.
Other vulnerabilities in Totolink A7100RU
See all- CVE-2026-5692High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5691High
Vulnerability in Totolink A7100RU router in the setFirewallType function in /cgi-bin/cstecgi.cgi. Manipulation of the firewallType argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5690High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setRemoteCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5689High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setNtpCfg function of /cgi-bin/cstecgi.cgi. Manipulating the tz argument allows remote command execution. A public exploit is available.
- CVE-2026-5678High
Vulnerability in Totolink A7100RU router in the setScheduleCfg function in /cgi-bin/cstecgi.cgi. Manipulation of the mode argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5677High
A security flaw in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection via the CsteSystem function in /cgi-bin/cstecgi.cgi by manipulating the resetFlags argument. The attack can be performed remotely and the exploit has been publicly released.
Original NVD description (English source)
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.