PT-2026-31590 · Totolink · Totolink A7100Ru

Ltzhust2 · Published 2026-03-27 · Updated 2026-04-10 · CVE-2026-5851

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A security flaw exists in the CGI Handler component of Totolink A7100RU 7.4cu.2313 b20191024. The setUPnPCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to os command injection through manipulation of the enable argument. This allows for remote execution of commands. The exploit has been publicly released and may be used for attacks.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2026-04979

CVE-2026-5851

Affected Products

Totolink A7100Ru

References · 11

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_157/README.md · Exploit
• https://bdu.fstec.ru/vul/2026-04979 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5851 · Security Note
• https://vuldb.com/vuln/356377 · Note
• https://totolink.net · Note
• https://twitter.com/CVEnew/status/2042186494564327662 · Twitter Post
• https://twitter.com/CVEarity/status/2042546587294142634 · Twitter Post
• https://vuldb.com/vuln/356377/cti · Note
• https://twitter.com/0dayPublishing/status/2042220867753529367 · Twitter Post
• https://twitter.com/OrizonCyber/status/2042188289587675640 · Twitter Post
• https://vuldb.com/submit/791271 · Note