CVE-2026-5997: Totolink A7100RU OS Command Injection in CGI Handler
A vulnerability in the CGI Handler of Totolink A7100RU firmware 7.4cu.2313_b20191024 allows OS command injection through the setLoginPasswordCfg function, according to the CNA VulDB record. The record says it can be triggered remotely and gives a CVSS 3.1 base score of 9.8 (critical). A public exploit is mentioned, but the device is not listed in CISA KEV and no fixed version appears in the sources consulted.
Overview
The CNA VulDB record describes an OS command injection issue in the setLoginPasswordCfg function, reached through the CGI Handler component of the Totolink A7100RU router firmware 7.4cu.2313_b20191024. The record classifies the weakness as CWE-77 (Command Injection). Details are summarized from the NVD entry and the VulDB entry.
Impact
Command injection can let a remote attacker run operating system commands on the affected device with the privileges of the vulnerable process. The CNA scores the issue at 9.8 under CVSS 3.1, with high confidentiality, integrity and availability impact and no privileges or user interaction required. The actual impact on a given deployment depends on how the device is exposed and configured.
Affected products and versions
- The record names one product version: Totolink A7100RU firmware 7.4cu.2313_b20191024.
- The structured affected-product list in the record is empty, so no range of affected versions can be confirmed.
- No fixed version is listed in the record.
Exploitation status
The record states that the exploit is public and may be used. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record. No confirmed exploitation in the wild appears in the sources consulted, so this analysis does not describe active exploitation.
Remediation and mitigation
- Check the Totolink website and the vendor support channels for a firmware update that addresses this issue, and confirm its version against the affected build.
- Until a fix is verified, limit access to the device management interface to trusted internal networks and disable remote administration where it is not needed.
- Do not expose the device web or CGI interface directly to the internet.
- Review device configuration and plan replacement if the vendor does not provide a fix for an unsupported model.
Detection guidance
- Review web server and CGI access logs for unexpected requests to the cstecgi.cgi endpoint, especially from unknown sources.
- Monitor device behavior for unexpected outbound connections, configuration changes or service restarts.
- Treat any unexplained change to administrative credentials or device settings as a potential compromise and investigate it.
Limitations of the available information
- The record has no confirmed fixed version, no vendor advisory and an empty list of affected versions.
- The record gives three CVSS views from the CNA (2.0, 3.1 and 4.0); the 3.1 score is used here as the primary reference.
- The EPSS value in the record carries a date later than the publication date, so its timing should be rechecked before use.
- No additional independent technical confirmation was available in the record.
Frequently asked questions
What is CVE-2026-5997?
It is a reported OS command injection issue in the setLoginPasswordCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024, scored 9.8 under CVSS 3.1 by the CNA.
Is this CVE known to be exploited in the wild?
The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit exists.
Is a fixed firmware version available?
No fixed version is listed in the record, and this cannot be confirmed from the sources consulted. Check the Totolink website and support channels.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.