CVE-2026-5850: Totolink A7100RU OS Command Injection in setVpnPassCfg
CVE-2026-5850 is a critical OS command injection flaw in the setVpnPassCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024, which the record says is remotely exploitable. The CNA-supplied CVSS 3.1 base score is 9.8, and the record states that a public exploit is available. No fixed version is listed in the sources consulted, and no confirmed active exploitation appears in them.
Overview
CVE-2026-5850 affects the setVpnPassCfg function reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A7100RU 7.4cu.2313_b20191024. According to the record, manipulation of the pptpPassThru argument leads to OS command injection (CWE-77).
Impact
- Confidentiality, integrity and availability: the CVSS 3.1 vector published by the CNA rates all three as High (C:H/I:H/A:H), with a network attack vector and no privileges or user interaction required.
- Scores: the CNA lists 9.8 (CVSS 3.1) and 8.9 (CVSS 4.0), plus an additional score; the record does not explain the differences between them.
- A successful command injection would generally allow commands to run on the device with the privileges of the affected service. This is an inference from the weakness class, not a outcome confirmed by the sources.
Affected products and versions
- Product named in the record: Totolink A7100RU, version 7.4cu.2313_b20191024.
- The structured affected list in the record is empty, so other versions are unknown.
- VulDB and the Totolink website are referenced, but the record gives no version-specific details from them.
Exploitation status
The record states that an exploit is publicly available and might be used. This CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation or exploitation in the wild appears in the sources consulted. EPSS gives a probability of 0.03253 (percentile 0.88039) at the recorded date.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check the vendor and the VulDB entry for updates.
- Until a vendor fix is verified, restrict access to the device management interface, avoid exposure to untrusted networks, and disable internet-facing administration where possible.
- Inventory Totolink A7100RU devices and prioritize those reachable from untrusted networks.
- Consider replacing unsupported devices if no vendor update is available.
Detection guidance
- Review web server and CGI logs for unusual requests to /cgi-bin/cstecgi.cgi, especially those targeting VPN or PPTP configuration.
- Monitor the device for unexpected configuration changes or outbound connections originating from it.
- Correlate with perimeter network telemetry. These are high-level indicators; the record does not provide specific signatures.
Limitations of the available information
- The record contains no fixed version, no affected version range beyond the single firmware string, and no vendor advisory content.
- The source status is recorded as Deferred, so enrichment may be incomplete.
- The record lists a third-party repository whose contents were not used to derive technical details here.
- Whether the different CVSS scores reflect the same analysis is unknown.
Frequently asked questions
Is CVE-2026-5850 known to be actively exploited?
The record does not list it in CISA KEV, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit is available, so reducing exposure should be a priority.
Which product and version are affected?
The record names Totolink A7100RU firmware 7.4cu.2313_b20191024. The structured affected list is empty, so other versions are unknown.
Is a fixed version available?
No fixed version is listed in the record. Check the vendor and the VulDB entry for updates and treat the status as unknown until confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.