CVE Intelligence
Analysis AI-assisted

CVE-2026-5994: Totolink A7100RU command injection via setTelnetCfg

A command injection flaw (CWE-77) has been published for the Totolink A7100RU firmware 7.4cu.2313_b20191024, affecting the setTelnetCfg function of the CGI Handler component. VulDB, as CNA, rates it 9.8 (critical) under CVSS 3.1 and describes remote exploitation. The record states that a public exploit exists, but the CVE is not listed in CISA KEV and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A command injection weakness (CWE-77) has been reported in the CGI Handler component of the Totolink A7100RU firmware 7.4cu.2313_b20191024. According to the record, the issue lies in the setTelnetCfg function and can be triggered remotely through manipulation of an input argument. The CVE was published on 2026-04-10 with VulDB as the CNA.

Impact

  • The CNA-provided CVSS 3.1 base score is 9.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector describes network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • Successful command injection would generally allow operating system commands to run on the device with the privileges of the affected service.

Affected products and versions

  • Product named in the description: Totolink A7100RU, version 7.4cu.2313_b20191024.
  • The structured affected list in the record is empty, so the full range of affected versions is unknown.
  • No fixed version is listed in the record.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
  • The description states that an exploit has been released to the public and may be used for attacks. No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is 0.03253, with percentile 0.88046.

Remediation and mitigation

  • Check the vendor website for firmware updates for the A7100RU. No fix is confirmed in the record.
  • Restrict access to the device management interface to trusted administrative networks and disable remote administration where it is not needed.
  • If no vendor fix is available, consider isolating or replacing the device.

Detection guidance

  • Review device and network logs for unexpected requests to the management interface and CGI endpoints.
  • Watch for unexpected changes to telnet service settings and for unusual outbound connections from the device.

Limitations of the available information

  • The record does not provide a fixed version, a complete affected version range or a vendor advisory.
  • The EPSS date in the record (2026-10-13) is later than the publication date, so that value should be verified against the source.
  • This analysis relies only on the sources listed in the record.

Frequently asked questions

Is CVE-2026-5994 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The description does state that a public exploit exists and may be used for attacks.

Which Totolink versions are fixed?

The record does not list any fixed version or vendor patch. Check the Totolink website and treat the fix status as unknown until confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.