CVE-2026-5854: Totolink A7100RU setWiFiEasyCfg OS Command Injection
CVE-2026-5854 is a critical OS command injection (CWE-77) in the setWiFiEasyCfg function of the CGI Handler component on Totolink A7100RU firmware 7.4cu.2313_b20191024. The CNA VulDB reports a CVSS 3.1 base score of 9.8 and says the issue can be triggered remotely, with a public exploit available. No confirmed exploitation in the wild appears in the consulted sources, and the record lists no affected or fixed versions.
Overview
VulDB, acting as CNA, published CVE-2026-5854 describing an OS command injection (CWE-77) in the setWiFiEasyCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of Totolink A7100RU firmware 7.4cu.2313_b20191024. The record places the issue in the web management interface handling of user-supplied input. Details are available in the VulDB entry.
Impact
- The CNA assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- The CNA also lists CVSS 4.0 (8.9) and CVSS 2.0 (10) scores, as reported in the record.
- Per the vector, the attack is network-reachable, requires no privileges and no user interaction. Successful exploitation would affect confidentiality, integrity and availability.
- Command injection in a router firmware component can allow an attacker to run operating system commands on the device, which is a high-impact outcome for network infrastructure.
Affected products and versions
- The record identifies the product as Totolink A7100RU, version 7.4cu.2313_b20191024.
- The structured affected-products list in the record is empty, so the full range of affected versions is unknown from the available data.
- Vendor information is available at Totolink, but no vendor advisory is cited in the record.
Exploitation status
- The record states that the exploit is public and may be used.
- The CISA KEV catalog does not list this CVE in the data provided, so no confirmed active exploitation is reported in the sources consulted.
- The EPSS probability is 0.03253 with a percentile of 0.8805, as recorded in the data provided.
Remediation and mitigation
- No fixed version is listed in the record. The absence of a listed fix does not mean none exists; check the vendor and the VulDB entry for updates.
- Inventory Totolink A7100RU devices and confirm whether the firmware version matches the one named in the record.
- Restrict access to the device management interface. Do not expose it to the internet, and limit it to trusted administrative networks.
- Replace or isolate devices that cannot receive a vendor fix, and follow the vendor guidance when it becomes available.
Detection guidance
- Review device and network logs for unexpected requests to the CGI management endpoints, especially from untrusted sources.
- Monitor for unexpected configuration changes or new processes and services on affected devices.
- Segment management traffic and alert on access attempts from outside approved administrative hosts.
Limitations of the available information
- The record does not list affected or fixed version ranges, so the exact scope is unknown.
- Only the CNA scores are present; no NVD-assigned scoring is included in the record data provided.
- Technical reproduction details are intentionally omitted here.
Frequently asked questions
What is CVE-2026-5854?
It is an OS command injection (CWE-77) in the setWiFiEasyCfg function of the CGI Handler component on Totolink A7100RU firmware 7.4cu.2313_b20191024, scored 9.8 critical under CVSS 3.1 by the CNA.
Is this vulnerability being actively exploited?
The record states a public exploit exists, but the CVE is not listed in the CISA KEV catalog in the data provided, so no confirmed active exploitation is reported in the sources consulted.
Which versions are fixed?
The record lists no fixed versions. The absence of a listed fix is unknown status, so check the vendor and the VulDB entry for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.