CVE Intelligence
Analysis AI-assisted

CVE-2026-5978: Totolink A7100RU OS Command Injection in setWiFiAclRules

CVE-2026-5978 is a command injection flaw (CWE-77) in the setWiFiAclRules function of the CGI Handler on the Totolink A7100RU, as described by the CNA VulDB. The CNA assigns a CVSS 3.1 base score of 9.8 and the record states the attack can be initiated remotely. The record also says a public exploit has been disclosed, but no confirmed exploitation in the wild appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5978 was published on 2026-04-09 and is attributed by the CNA cna@vuldb.com to a command injection weakness (CWE-77) in the setWiFiAclRules function, reachable through /cgi-bin/cstecgi.cgi in the CGI Handler component. The record names the Totolink A7100RU, version 7.4cu.2313_b20191024, as the affected build. The record's title field is empty, so the title in this analysis is derived from the description.

Impact

  • The CNA's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable issue requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability. This is the CNA's scoring, not an independent assessment.
  • Command injection flaws generally allow an attacker to run operating system commands on the device with the privileges of the vulnerable service. This is an inference from the CWE class and has not been verified by the sources.
  • Additional CNA scores are listed as CVSS 4.0 8.9 and CVSS 2.0 10.

Affected products and versions

  • Product in the record: Totolink A7100RU, version 7.4cu.2313_b20191024.
  • The record's affected list is empty, so no further version range is confirmed.
  • Vendor information is available at Totolink.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is established by the sources consulted.
  • The record states that an exploit has been publicly disclosed and may be used. Public availability of exploit material raises risk, but this analysis does not assess its quality or reliability.
  • EPSS in the record is 0.03253 (percentile 0.88042), dated 2026-10-13 as recorded.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists; the vendor and advisory sources should be checked for firmware updates.
  • Until a vendor fix is confirmed, consider restricting access to the device's web management interface, placing it behind network segmentation, and removing exposure to untrusted networks.
  • Review whether affected devices are reachable from the internet and prioritize them given the critical CNA score.

Detection guidance

  • Review web management and CGI access logs for unusual requests to /cgi-bin/cstecgi.cgi, particularly from unexpected sources.
  • Monitor for unexpected configuration changes, new processes or outbound connections originating from the device.
  • Maintain an inventory of Totolink A7100RU devices and their firmware versions to support triage.

Limitations of the available information

  • The record contains no confirmed fixed version, no affected version range beyond the single build listed, and no vendor advisory text.
  • The title field was null in the record.
  • The EPSS date (2026-10-13) is later than the publication date, which should be verified against the source before relying on it.
  • The exploit referenced by the record is not described in detail and was not analyzed.

Frequently asked questions

What is CVE-2026-5978?

It is a command injection weakness (CWE-77) in the setWiFiAclRules function of the CGI Handler on the Totolink A7100RU, according to the CNA VulDB record.

Is this vulnerability known to be actively exploited?

The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Is there a fixed version?

The record lists no fixed version. This does not mean no fix exists, so check the vendor and advisory sources for firmware updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.