CVE Intelligence
Analysis AI-assisted

CVE-2026-5977: Totolink A7100RU OS Command Injection in setWiFiBasicCfg

CVE-2026-5977 is a critical OS command injection weakness (CWE-77) in the CGI Handler of the Totolink A7100RU, affecting version 7.4cu.2313_b20191024 as named in the record. The record states that manipulating the wifiOff argument of the setWiFiBasicCfg function can lead to command execution and that remote attacks are possible. An exploit is described as publicly available, but the record does not show KEV listing or confirmed exploitation in the wild.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5977 is an OS command injection weakness (CWE-77) reported in the CGI Handler of the Totolink A7100RU, firmware string 7.4cu.2313_b20191024. According to the record, the setWiFiBasicCfg function reached through /cgi-bin/cstecgi.cgi can lead to command injection when the wifiOff argument is manipulated. The CNA is VulDB, and details are available at VulDB entry 356531.

Impact

Command injection can allow an attacker to run operating system commands on the affected device. The record states that the attack can be launched remotely.

  • The CVSS 3.1 base score given by the CNA is 9.8 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Inference: the practical impact depends on the privileges of the vulnerable service and the device configuration, which the record does not describe.

Affected products and versions

  • Totolink A7100RU, version 7.4cu.2313_b20191024, as named in the record.
  • The record's affected and fixes lists are empty. No other affected version range is confirmed by the sources consulted.
  • Vendor information is available at the Totolink website, but it was not used to confirm version ranges.

Exploitation status

The record's KEV field shows the CVE is not listed in the CISA KEV catalog. The description states that an exploit has been made available to the public. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.03253 with a percentile of 0.88041 as provided in the record.

Remediation and mitigation

  • The record contains no fixed version. Check the vendor channels for firmware updates for the A7100RU and apply them when available.
  • Restrict access to the device web and CGI management interfaces to trusted administrative networks only.
  • Disable remote management on the WAN side if it is not required.
  • Because a public exploit is described, prioritize inventory and remediation of affected devices, especially those exposed to the internet.
  • Where patching is not yet possible, reduce exposure through network segmentation and access control lists.

Detection guidance

  • Review device and perimeter logs for unusual requests to CGI endpoints on the router management interface.
  • Watch for unexpected changes to Wi-Fi settings, unexplained device restarts, or outbound connections from the router that are not normally seen.
  • Keep an inventory of firmware versions so that devices matching the affected version string can be identified quickly.

Limitations of the available information

  • The record has no confirmed list of affected versions and no fixed version, so the affected range is unknown beyond the version string named in the description.
  • The record does not include a CVSS 4.0 vector string, although a 4.0 score is listed in the scores data.
  • Whether vendor patches exist is unknown from the sources in the record.
  • The publication status is Deferred in the record, and the sources consulted do not provide further technical detail.

Frequently asked questions

What is CVE-2026-5977?

It is an OS command injection weakness (CWE-77) in the setWiFiBasicCfg function of the CGI Handler on the Totolink A7100RU, according to the record. The CNA rates it critical with a CVSS 3.1 score of 9.8.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been made available.

Which versions are affected and is there a fix?

The record names version 7.4cu.2313_b20191024 and provides no fixed version or additional affected versions. Check the vendor channels for firmware updates.

What should administrators do now?

Restrict access to the device management interfaces, disable remote management if it is not needed, segment the network, and monitor for unusual activity while waiting for a vendor fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.