PT-2026-31739 · Totolink · Totolink A7100Ru

Ltzhuster2 · Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5978

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A security issue exists in the Totolink A7100RU version 7.4cu.2313 b20191024. The setWiFiAclRules function within the /cgi-bin/cstecgi.cgi file, part of the CGI Handler component, is susceptible to OS command injection. The mode argument can be manipulated to achieve this. The attack can be initiated remotely and an exploit has been publicly disclosed.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-5978

Affected Products

Totolink A7100Ru

References · 8

• 🔥 https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_164/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5978 · Security Note
• https://twitter.com/CVEnew/status/2042355094801248430 · Twitter Post
• https://totolink.net · Note
• https://vuldb.com/submit/791825 · Note
• https://vuldb.com/vuln/356532/cti · Note
• https://vuldb.com/vuln/356532 · Note
• https://twitter.com/CveFindCom/status/2042357686931526093 · Twitter Post