CVE-2026-5689
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setNtpCfg function of /cgi-bin/cstecgi.cgi. Manipulating the tz argument allows remote command execution. A public exploit is available.
Risk Assessment
A remote, unauthenticated attacker could take full control of the router, potentially compromising network security and intercepting traffic.
Recommendation
Immediately update the Totolink A7100RU firmware to the latest version if available, or consider replacing the device with a supported model.
Other vulnerabilities in Totolink A7100RU
See all- CVE-2026-5692High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5691High
Vulnerability in Totolink A7100RU router in the setFirewallType function in /cgi-bin/cstecgi.cgi. Manipulation of the firewallType argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5690High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setRemoteCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5688High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Manipulating the provider argument allows remote command execution. A public exploit is available.
- CVE-2026-5678High
Vulnerability in Totolink A7100RU router in the setScheduleCfg function in /cgi-bin/cstecgi.cgi. Manipulation of the mode argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5677High
A security flaw in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection via the CsteSystem function in /cgi-bin/cstecgi.cgi by manipulating the resetFlags argument. The attack can be performed remotely and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument tz results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.