CVE Intelligence
Analysis AI-assisted

CVE-2026-5996: Totolink A7100RU CGI Handler OS Command Injection

A command injection flaw (CWE-77) was reported in the setAdvancedInfoShow function of the CGI Handler on Totolink A7100RU firmware 7.4cu.2313_b20191024, through the tty_server argument. The CNA VulDB rates it critical with CVSS 3.1 score 9.8 and describes remote attack potential. The record states the exploit was publicly disclosed, but the CVE is not listed in CISA KEV and no fixed version appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-5996 describes an OS command injection weakness (CWE-77) in the CGI Handler component of the Totolink A7100RU. The record places the issue in the setAdvancedInfoShow function reached through /cgi-bin/cstecgi.cgi, and states that manipulating the tty_server argument can lead to command injection that may be started remotely.

Impact

  • The CNA VulDB assigns CVSS 3.1 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction.
  • The same provider also lists CVSS 4.0 8.9 and CVSS 2.0 10.
  • In general terms, successful OS command injection allows commands to run on the device with the privileges of the vulnerable service. The record does not describe the specific consequences for this product.

Affected products and versions

  • Product named in the description: Totolink A7100RU, version 7.4cu.2313_b20191024.
  • The structured affected list in the record is empty, so the full range of affected versions is unknown.
  • The record lists no fixed version. This does not prove that no fix exists.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
  • The description states that the exploit has been publicly disclosed and may be used. Public exploit availability raises risk even without confirmed in-the-wild activity.
  • The EPSS value in the record is a probability of 0.03253 with a percentile of 0.88045, which estimates the likelihood of exploitation activity over the coming 30 days.

Remediation and mitigation

  • Check the Totolink website for firmware updates for the A7100RU and apply any newer firmware the vendor publishes, after verifying it covers this issue.
  • Until a fix is confirmed, keep the device's management interface away from the internet, place it behind a firewall, and restrict administrative access to trusted networks.
  • If the vendor no longer supports the model, plan to replace the device, since the sources do not indicate a fix.
  • Follow the VulDB entry and the NVD record for updates.

Detection guidance

  • Review web server and network logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from sources outside the management network.
  • Monitor the device for unexpected configuration changes, new accounts, or outbound connections it initiates.
  • Confirm the installed firmware version against the affected version string to know whether the device is in scope.

Limitations of the available information

  • The sources consulted do not include a vendor advisory, a fixed version or a verified affected version range.
  • The record's title field is empty, and the structured affected and fixes lists are empty.
  • The record's source status is Deferred, so details may change.
  • The EPSS date in the record is later than the publication date. The figures are reported as recorded.
  • This analysis relies only on the cited record and sources.

Frequently asked questions

Is CVE-2026-5996 being actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit has been disclosed and may be used, so affected devices should be prioritized.

Which versions are affected?

The description names Totolink A7100RU version 7.4cu.2313_b20191024. The structured affected list in the record is empty, so other versions are unknown.

Is there a fix available?

The record lists no fixed version. Check the vendor site and the VulDB entry for updates, since the absence of data in the record does not mean no fix exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.