PT-2026-31593 · Totolink · Totolink A7100Ru

Ltzhuster2 · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-5854

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A vulnerability exists in the Totolink A7100RU device that allows for remote operating system command injection. This is due to a flaw in the setWiFiEasyCfg function within the /cgi-bin/cstecgi.cgi file, part of the CGI Handler component. Manipulation of the merge argument can lead to the execution of arbitrary commands on the system. The exploit for this issue is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /cgi-bin/cstecgi.cgi file.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-5854

Affected Products

Totolink A7100Ru

References · 13

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_160/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5854 · Security Note
• https://twitter.com/CVEarity/status/2042554927181107572 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042182845834084483 · Twitter Post
• https://vuldb.com/vuln/356380 · Note
• https://vuldb.com/vuln/356380/cti · Note
• https://twitter.com/infoflowcloud/status/2042187415301882304 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/submit/791276 · Note
• https://twitter.com/CveFindCom/status/2042138555183485269 · Twitter Post
• https://twitter.com/cyberbivash/status/2042168672328774030 · Twitter Post
• https://twitter.com/CVEnew/status/2042186491678654631 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042232208220418455 · Twitter Post