CVE Intelligence
Analysis AI-assisted

CVE-2026-5995: Totolink A7100RU OS Command Injection in setMiniuiHomeInfoShow

A command injection weakness (CWE-77) in the CGI handler of Totolink A7100RU firmware 7.4cu.2313_b20191024 can be triggered remotely through the lan_info argument. The CNA scores it CVSS 3.1 9.8 (critical), and the record states that a public exploit is available. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A weakness in the CGI handler of the Totolink A7100RU router, firmware 7.4cu.2313_b20191024, allows operating system commands to be injected through the lan_info argument of the setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. The record classifies the issue as CWE-77 (Command Injection).

Impact

  • The CNA describes the attack as performable remotely.
  • The CVSS 3.1 base score of 9.8 (critical) from the CNA vector indicates network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • Inference: successful command injection on a network device would typically allow an attacker to control the device and use it as a foothold on the local network.

Affected products and versions

  • The record names Totolink A7100RU, firmware 7.4cu.2313_b20191024, as the impacted version.
  • The structured affected and fixed version fields are empty in the record.
  • Whether other firmware versions are affected is unknown.

Exploitation status

  • The record states that an exploit has been made publicly available and could be used for attacks.
  • The record shows the CVE is not listed in CISA KEV, so this analysis does not report active exploitation.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • No vendor fix is listed in the record. Check the Totolink website for firmware updates for the A7100RU.
  • Until an update is confirmed, restrict access to the device management interface, do not expose it to the internet, and place the device on a segmented network away from untrusted hosts.
  • If no supported firmware is available, plan to replace the device.

Detection guidance

  • Review web server and CGI request logs on the device, where available, for unusual requests to /cgi-bin/cstecgi.cgi.
  • Monitor traffic to and from router management interfaces for unexpected external connections or unusual outbound activity.
  • Look for unexpected configuration changes, new accounts or unknown processes on affected devices.

Limitations of the available information

  • The record contains no vendor advisory, no fixed version and no affected range beyond the single firmware string.
  • The CNA also lists a CVSS 4.0 score of 8.9 and a CVSS 2.0 score of 10, but the record does not provide their vectors.
  • The EPSS values are statistical estimates and do not confirm exploitation.
  • The record has a Deferred source status, so the NVD analysis may change.

Frequently asked questions

What is CVE-2026-5995?

It is a command injection weakness (CWE-77) in the setMiniuiHomeInfoShow function of the CGI handler on Totolink A7100RU firmware 7.4cu.2313_b20191024, triggered through the lan_info argument.

Is this vulnerability being actively exploited?

The record does not list the CVE in CISA KEV and shows no confirmed exploitation in the sources consulted. It does state that a public exploit has been made available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.