CVE Intelligence
Analysis AI-assisted

CVE-2026-5976: Totolink A7100RU CGI Handler OS Command Injection via setStorageCfg

A flaw in the setStorageCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the sambaEnabled argument. The record reports remote reachability and a publicly released exploit, and the CNA scores it 9.8 under CVSS 3.1. The record is not listed in CISA KEV, and it provides no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an OS command injection flaw (CWE-77) in the setStorageCfg function, reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of the Totolink A7100RU, firmware 7.4cu.2313_b20191024. According to the description, malicious input supplied through the sambaEnabled argument can lead to operating system command execution. Details are taken from the VulDB entry and the NVD record.

Impact

  • The CNA (VulDB) assigns a CVSS 3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack with no privileges or user interaction.
  • The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10.
  • Command execution on a router would generally let an attacker act with the device's privileges. The actual consequences depend on firmware details that are not in the record.

Affected products and versions

  • Product: Totolink A7100RU.
  • Version named in the description: 7.4cu.2313_b20191024.
  • The record's affected list is empty, so other versions are unknown. Product information is available from the Totolink website.

Exploitation status

The record shows kev.listed as false, so it is not in the CISA KEV catalog. The description states that an exploit has been released publicly and may be used for attacks. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version. That absence does not mean no fix exists, so check the vendor's firmware updates and advisories for this model.
  • Do not expose the router's management interface to the internet. Restrict administrative access to trusted internal networks.
  • If no vendor update is available for the affected firmware, plan to isolate or replace the device.
  • Apply a patch or firmware update as soon as it is verified, and then confirm the running version.

Detection guidance

  • Review device logs, when available, for unexpected requests to the CGI interface.
  • Watch for unexpected configuration changes on the router, new administrative accounts, or outbound connections initiated by the device.
  • Monitor traffic to management ports from untrusted sources.

Limitations of the available information

  • The affected and fixes lists are empty, so the exact vulnerable and fixed versions are unknown.
  • No vendor advisory is cited in the record.
  • The EPSS probability is 0.03253 with a percentile of 0.88041, dated 2026-10-13. EPSS estimates exploitation likelihood and is not a measure of severity.
  • The record's source status is Deferred, so the information may change.

Frequently asked questions

Is CVE-2026-5976 being actively exploited?

The record shows the CVE is not in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The description does say a public exploit has been released and may be used for attacks.

Which Totolink A7100RU versions are affected?

The description names firmware 7.4cu.2313_b20191024. The record's affected list is empty, so other versions are unknown and should be checked with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.