CVE Intelligence
Analysis AI-assisted

CVE-2026-5852: Totolink A7100RU Command Injection in setIptvCfg

A command injection weakness (CWE-77) has been reported in the setIptvCfg function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024. According to the CNA, the igmpVer argument can be manipulated remotely to run operating system commands, and the record states that an exploit has been made public. The CNA rates it CVSS 3.1 9.8 (critical), and CISA KEV does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection weakness has been reported in the setIptvCfg function of the CGI Handler, reachable through /cgi-bin/cstecgi.cgi on Totolink A7100RU firmware 7.4cu.2313_b20191024. The record names the igmpVer argument as the manipulated input. The source status is listed as Deferred, so the CNA entry may still change.

Impact

  • The CNA rates the issue critical with CVSS 3.1 base score 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector indicates network reachability, low complexity, no privileges or user interaction, and high impact to confidentiality, integrity and availability.
  • Command injection can allow an attacker to run operating system commands on the device when input is not properly validated.
  • The same CNA also lists CVSS 4.0 at 8.9 and CVSS 2.0 at 10.

Affected products and versions

  • The record names Totolink A7100RU firmware 7.4cu.2313_b20191024.
  • The record contains no structured affected or fixed version ranges.

Exploitation status

  • The record states that an exploit has been made publicly available and could be used for attacks.
  • CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted.
  • The record shows an EPSS probability of 0.03253 and a percentile of 0.88049.

Remediation and mitigation

  • No vendor fix is identified in the record. Check the Totolink website for firmware updates for the A7100RU and apply any update the vendor confirms addresses this issue.
  • Until a fix is verified, reduce exposure. Keep the device administration interface off the internet, restrict management access to trusted networks, and disable IPTV-related features that are not required.
  • Prioritize inventory of devices running this firmware because of the critical score and the public exploit statement.

Detection guidance

  • Review device configuration and logs for unexpected changes to IPTV or multicast settings.
  • Monitor traffic to management interfaces for requests to the CGI handler from unexpected sources.
  • Compare deployed firmware versions against the named version to identify exposed devices.

Limitations of the available information

  • The record does not provide affected version ranges, fixed versions, vendor advisory text, or details of the public exploit. Whether other firmware versions are affected is unknown.
  • The CVSS values come from the CNA entry. The record does not include a separate NVD-assigned score.
  • The EPSS values are shown as recorded, with a date of 2026-10-13.

Frequently asked questions

Is CVE-2026-5852 being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been made available, so monitoring is advisable.

Which Totolink device and firmware are named?

The record names the Totolink A7100RU with firmware 7.4cu.2313_b20191024. It does not list other affected versions, so the scope beyond that version is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.