PT-2026-31593 · Totolink · A7100Ru

Ltzhuster2 · Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5854

Mitre

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was detected in Totolink A7100RU 7.4cu.2313 b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-5854

Affected Products

A7100Ru

References · 6

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_160/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5854 · Security Note
• https://vuldb.com/vuln/356380 · Note
• https://vuldb.com/submit/791276 · Note
• https://vuldb.com/vuln/356380/cti · Note
• https://totolink.net · Note