PT-2026-31738 · Totolink · Totolink A7100Ru

Ltzhuster2 · Published 2026-04-09 · Updated 2026-04-19 · CVE-2026-5977

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A weakness exists in Totolink A7100RU version 7.4cu.2313 b20191024. The setWiFiBasicCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component is affected. Manipulation of the wifiOff argument can lead to OS command injection, allowing for remote attacks. The exploit has been made publicly available.

Recommendations For Totolink A7100RU version 7.4cu.2313 b20191024, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-5977

Affected Products

Totolink A7100Ru

References · 11

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_163/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5977 · Security Note
• https://twitter.com/giuseppe_1337/status/2045700341853761940 · Twitter Post
• https://twitter.com/CVEnew/status/2042355097510842767 · Twitter Post
• https://vuldb.com/submit/791823 · Note
• https://vuldb.com/vuln/356531/cti · Note
• https://twitter.com/CveFindCom/status/2042357640685146251 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042356124091924787 · Twitter Post
• https://vuldb.com/vuln/356531 · Note
• https://twitter.com/OrizonCyber/status/2042429873226948914 · Twitter Post
• https://totolink.net · Note