CVE Intelligence
Analysis AI-assisted

CVE-2026-5851: Totolink A7100RU OS Command Injection in setUPnPCfg

CVE-2026-5851 is a command injection flaw in the setUPnPCfg function of the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable remotely through /cgi-bin/cstecgi.cgi. The CNA VulDB scores it 9.8 under CVSS 3.1, and the record states that an exploit has been published. The record lists no KEV entry and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A security flaw was reported in the Totolink A7100RU, identified in the record as firmware 7.4cu.2313_b20191024. The issue is in the setUPnPCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component. The weakness is classified as CWE-77 (command injection), meaning input handled by the function can influence operating system commands. The record was published on 2026-04-09 by the CNA VulDB and is currently marked as Deferred in its source status.

Impact

The CNA VulDB scores the issue 9.8 under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. According to that vector, the attack is network-based, needs no privileges, needs no user interaction, and could affect confidentiality, integrity and availability at the high level. The same CNA also provides a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.

Affected products and versions

  • Product named in the record: Totolink A7100RU.
  • Version named in the record: 7.4cu.2313_b20191024.
  • The structured affected list in the record is empty, so the exact scope of affected builds is unknown beyond the version named in the description.
  • The record contains no fixed version. This does not mean no fix exists; it means the available data does not show one.

Exploitation status

The record states that an exploit has been released to the public and may be used for attacks. The CISA KEV catalog entry is marked as not listed, so this analysis does not describe the vulnerability as actively exploited in the wild. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.03253 with a percentile of 0.8805, as recorded for the date 2026-10-13.

Remediation and mitigation

  • Check the vendor site at totolink.net for firmware updates for the A7100RU and apply any update that addresses this issue.
  • Because no fixed version is listed in the record, treat every unpatched device as exposed until the vendor confirms a fix.
  • Do not expose the device administration or CGI interfaces to the internet. Keep them on a restricted management network.
  • If UPnP is not required, disable it on the device, since the affected function is part of the UPnP configuration path.
  • Replace devices that the vendor no longer supports with a maintained model.

Detection guidance

  • Inventory all Totolink A7100RU devices and record their firmware versions.
  • Review network logs for unexpected inbound traffic reaching the device web or CGI interface from untrusted sources.
  • Monitor device behavior for unexpected outbound connections or configuration changes, which may indicate abuse of a command execution flaw.
  • Keep logs from edge devices and forward them to a central system for retention and review.

Limitations of the available information

The sources consulted are the CVE record, the NVD and CVE.org record pages, the VulDB entry, and a public GitHub repository referenced in the record. The record contains no vendor advisory, no fixed version, no affected version range beyond the single version named, and no independent confirmation of the exploit. The CVSS scores come from the CNA. The EPSS date is later than the publication date, so the EPSS values should be re-checked against a current source.

Frequently asked questions

What is CVE-2026-5851?

It is a command injection flaw (CWE-77) in the setUPnPCfg function of the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024, reachable remotely.

Is this vulnerability actively exploited?

The record states that a public exploit exists, but it is not listed in the CISA KEV catalog and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. The vendor site should be checked for firmware updates, and devices should be treated as exposed until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.