CVE-2026-5691
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
Vulnerability in Totolink A7100RU router in the setFirewallType function in /cgi-bin/cstecgi.cgi. Manipulation of the firewallType argument leads to OS command injection. The attack can be carried out remotely.
Risk Assessment
An attacker can remotely execute arbitrary commands on the device, potentially leading to full compromise of the router and network.
Recommendation
Update the router firmware to the latest version or apply the available patch. If not possible, restrict management interface access to trusted networks only.
Other vulnerabilities in Totolink A7100RU
See all- CVE-2026-5692High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5690High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setRemoteCfg function of /cgi-bin/cstecgi.cgi. Manipulating the enable argument allows remote command execution. A public exploit is available.
- CVE-2026-5689High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setNtpCfg function of /cgi-bin/cstecgi.cgi. Manipulating the tz argument allows remote command execution. A public exploit is available.
- CVE-2026-5688High
The Totolink A7100RU router firmware version 7.4cu.2313_b20191024 is vulnerable to OS command injection in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Manipulating the provider argument allows remote command execution. A public exploit is available.
- CVE-2026-5678High
Vulnerability in Totolink A7100RU router in the setScheduleCfg function in /cgi-bin/cstecgi.cgi. Manipulation of the mode argument leads to OS command injection. The attack can be carried out remotely.
- CVE-2026-5677High
A security flaw in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection via the CsteSystem function in /cgi-bin/cstecgi.cgi by manipulating the resetFlags argument. The attack can be performed remotely and the exploit has been publicly released.
Original NVD description (English source)
A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setFirewallType of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument firewallType leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.