CVE Intelligence
Analysis AI-assisted

CVE-2026-5993: Totolink A7100RU Command Injection in setWiFiGuestCfg

CVE-2026-5993 is a command injection flaw (CWE-77) in the setWiFiGuestCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024, triggered through the wifiOff argument and reachable remotely. The CNA vuldb assigned a CVSS 3.1 score of 9.8 and the record states a public exploit is available. The record does not list the CVE in CISA KEV and provides no affected or fixed version data.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5993 affects the setWiFiGuestCfg function reached through /cgi-bin/cstecgi.cgi in the CGI Handler component of the Totolink A7100RU, firmware 7.4cu.2313_b20191024. The weakness is classified as CWE-77 (Command Injection). Per the record, manipulation of the wifiOff argument leads to operating system command injection.

Impact

  • The CNA vuldb scored the issue 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which describes network attack vector, no privileges and no user interaction.
  • Other CVSS scores in the record are 8.9 under version 4.0 and 10 under version 2.0, both from the same CNA.
  • Successful command injection on a router could allow an attacker to affect confidentiality, integrity and availability of the device, but the record does not describe the specific consequences.

Affected products and versions

  • Product: Totolink A7100RU, firmware 7.4cu.2313_b20191024, as stated in the record.
  • The structured affected-products list in the record is empty, so other versions are unknown.
  • No fixed version is listed in the record. The absence of a fixed version does not mean no fix exists.

Exploitation status

  • The CISA KEV entry is not listed in the record, so no confirmed active exploitation is reported by that catalogue.
  • The CNA description states that the exploit is publicly available and might be used. This is a public availability statement, not evidence of observed attacks.
  • The EPSS probability in the record is 0.03253 with percentile 0.88046.

Remediation and mitigation

  • Check the vendor site Totolink for firmware updates for the A7100RU and apply any fix available for your model and region.
  • Until a verified fix is installed, restrict access to the router administration interface, avoid exposing it to the internet, and place it behind network controls that limit who can reach the CGI endpoints.
  • Inventory all Totolink A7100RU devices, including guest network configurations, and prioritise those reachable from untrusted networks.

Detection guidance

  • Review router and network logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially requests that reference guest Wi-Fi configuration.
  • Monitor for unexpected outbound connections or configuration changes on the device.
  • Treat any device showing signs of compromise as untrusted and follow your incident response process.

Limitations of the available information

  • The record gives no affected version range, no fixed version and no vendor advisory text.
  • The EPSS date in the record (2026-10-13) is later than the publication date (2026-04-10), so its timing should be verified before relying on it.
  • Whether the exploit has been used against real devices is not established by the sources consulted.

Frequently asked questions

Is CVE-2026-5993 being actively exploited?

The record does not list it in CISA KEV, so no confirmed active exploitation is reported there. The CNA states that a public exploit is available and might be used, which is not the same as observed attacks.

Which Totolink A7100RU versions are affected?

The record names firmware 7.4cu.2313_b20191024 only. The structured affected list is empty, so other versions cannot be confirmed from the sources provided.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.