CVE Intelligence
Analysis AI-assisted

CVE-2026-5975: Totolink A7100RU OS Command Injection in setDmzCfg

CVE-2026-5975 is an OS command injection flaw in the setDmzCfg function of the CGI Handler on the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The CNA rates it critical with a CVSS 3.1 score of 9.8, and the record states that a public exploit is available. The record does not list a fixed version and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CGI Handler component of the Totolink A7100RU, firmware 7.4cu.2313_b20191024, contains a flaw in the setDmzCfg function reached through /cgi-bin/cstecgi.cgi. According to the record, manipulating the wanIdx argument can lead to operating system command injection (CWE-77), and the attack can be launched remotely.

Impact

  • The CNA rates the issue critical, with a CVSS 3.1 base score of 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes a network attack needing no privileges or user interaction, with high confidentiality, integrity and availability impact.
  • The same CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
  • Successful command injection on a router would typically let an attacker run commands with the privileges of the affected service. The record does not detail the exact effect on this firmware.

Affected products and versions

  • Product: Totolink A7100RU.
  • Version named in the record: 7.4cu.2313_b20191024.
  • The structured affected list in the record is empty, so the full range of affected versions is unknown.

Exploitation status

  • The record states that the exploit is publicly available and might be used.
  • The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted.
  • The record includes an EPSS probability of 0.03253 and a percentile of 0.88041.

Remediation and mitigation

  • The record lists no fixed version. This is unknown and does not mean no fix exists. Check the vendor site and the referenced entries for updates.
  • Until an update is confirmed, reduce exposure: keep management interfaces off the public internet, restrict administrative access to trusted networks, and plan replacement for devices that no longer receive firmware updates.
  • Change default administrative credentials and review device configuration.

Detection guidance

  • Review device and upstream logs for unexpected requests to the management CGI interface, particularly to the DMZ configuration function.
  • Look for unauthorized configuration changes, unfamiliar processes, or unexpected outbound connections from the router.
  • Inventory internet-facing devices of this model and prioritize them for review.

Limitations of the available information

  • The record has no fixed version, no vendor advisory text, and only one firmware string in the affected information.
  • The description comes from the CNA (VulDB). The vendor response is not stated.
  • The source status is recorded as Deferred, so scores and details may change as analysis continues.

Frequently asked questions

Is CVE-2026-5975 being actively exploited?

The record says a public exploit is available, but the CVE is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted.

Which firmware is named as affected?

The description names the Totolink A7100RU firmware 7.4cu.2313_b20191024. The structured affected list is empty, so other versions are unknown.

Is a fixed version available?

The record lists no fixed version. This is unknown rather than proof that no fix exists, so check the vendor site and referenced entries.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.