CVE Intelligence
Analysis AI-assisted

CVE-2026-5853: Totolink A7100RU OS Command Injection via setIpv6LanCfg

CVE-2026-5853 is an OS command injection flaw (CWE-77) in the setIpv6LanCfg function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The CNA rates it critical, with a CVSS 3.1 score of 9.8 and a network attack vector requiring no privileges or user interaction. The record states that an exploit has been publicly disclosed, but the CISA KEV catalog does not list it and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection flaw (CWE-77) in the Totolink A7100RU, firmware 7.4cu.2313_b20191024. According to the record, the issue is in the setIpv6LanCfg function reached through the CGI Handler at /cgi-bin/cstecgi.cgi, where the addrPrefixLen argument is handled unsafely. The entry is tracked by VulDB and NVD.

Impact

  • The CNA vector (CVSS 3.1, score 9.8) indicates a network attack vector, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • The CNA also lists CVSS 4.0 at 8.9 and CVSS 2.0 at 10.
  • Successful OS command injection on a router would normally let an attacker run commands on the device. The record does not describe the outcome, so this is an inference.

Affected products and versions

  • Product named in the record: Totolink A7100RU.
  • Version named in the record: 7.4cu.2313_b20191024.
  • The affected list in the record is empty, so other versions or hardware revisions are unknown.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
  • The record's description states that the exploit has been publicly disclosed and may be used. This is a statement from the description and was not verified against an independent source.
  • The record reports an EPSS probability of 0.03253 and a percentile of 0.88049.

Remediation and mitigation

  • No fixed version is listed in the record. This does not mean no fix exists. Check the vendor site at Totolink for firmware updates for this model.
  • Until a verified fix is installed, disable remote administration, restrict management access to trusted internal networks, and keep the device off direct internet exposure.
  • If no vendor update is available and the device is exposed, consider replacing or isolating it.

Detection guidance

  • Review device and network logs for unexpected requests to the management CGI endpoint, particularly requests that change IPv6 LAN configuration.
  • Look for unexpected configuration changes, unfamiliar processes, or outbound connections originating from the router.
  • Monitor traffic from the device to unknown external hosts and alert on unusual volumes.

Limitations of the available information

  • The record contains no affected version range, no fixed version and no vendor advisory.
  • The source status is Deferred, so details may change.
  • The technical details come from the CNA entry and were not independently reproduced or verified.

Frequently asked questions

What is CVE-2026-5853?

It is an OS command injection vulnerability (CWE-77) in the setIpv6LanCfg function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024, according to the record.

Is CVE-2026-5853 known to be actively exploited?

It is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record states that an exploit has been publicly disclosed.

Is there a fixed version?

The record does not list a fixed version. The absence of one is unknown information, not proof that no fix exists, so check the vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.