---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the proto argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router enables unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6114

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setNetworkCfg function in /cgi-bin/cstecgi.cgi fails to properly sanitize the proto argument, allowing an unauthenticated attacker to inject and execute arbitrary OS commands.

Business Impact

The CVSS score of 9.8 reflects the high probability and impact of this vulnerability. Compromise of the router allows for total network visibility and control, posing a dire risk to the confidentiality, integrity, and availability of all connected systems.

Remediation Plan

Immediate Action: Update the device to the most recent firmware version available from the manufacturer.

Proactive Monitoring: Monitor for anomalous system behavior and unauthorized configuration changes on the router.

Compensating Controls: Disable remote management interfaces and restrict access to the device's web management console to authorized personnel only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high; patching is mandatory.

Analyst Recommendation

This is a critical vulnerability that can be exploited remotely by unauthenticated attackers. Security teams must prioritize updating affected devices and limiting exposure to untrusted networks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the ttyEnable argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-6113

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability resides in the setTtyServiceCfg function in /cgi-bin/cstecgi.cgi. An unauthenticated attacker can manipulate the ttyEnable argument to trigger OS command injection.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. An attacker can compromise the device to intercept traffic, conduct man-in-the-middle attacks, or pivot into the internal network, leading to severe reputational and security consequences for the organization.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by the vendor to remediate the vulnerable CGI handler.

Proactive Monitoring: Review web server logs for suspicious CGI requests containing command-line injection patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent ingress filtering to block malicious requests directed at /cgi-bin/cstecgi.cgi.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high, requiring urgent attention from security teams.

Analyst Recommendation

Given the critical severity and the availability of public exploits, this vulnerability must be addressed immediately. Ensure all vulnerable routers are updated and isolated from public access where possible.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the maxRtrAdvInterval argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6112

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability exists in the setRadvdCfg function within /cgi-bin/cstecgi.cgi. An unauthenticated attacker can inject arbitrary OS commands by manipulating the maxRtrAdvInterval argument.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with elevated privileges on the affected device. Given the CVSS score of 9.8, this vulnerability presents a critical threat, potentially leading to unauthorized network access, data exfiltration, or the inclusion of the device in a botnet, causing significant operational downtime.

Remediation Plan

Immediate Action: Update the affected device firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Inspect system and firewall logs for unusual outbound traffic or unexpected command execution patterns originating from the router's management interface.

Compensating Controls: Restrict access to the router’s management interface to trusted internal IP addresses and disable remote administration features until the patch is applied.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of active exploitation is high; immediate patching is required.

Analyst Recommendation

The presence of a public exploit for a critical command injection flaw necessitates immediate remediation. Administrators should prioritize updating the affected Totolink routers and ensuring that management interfaces are not exposed to the public internet.

---METADATA---
VENDOR: Perfree
PRODUCT: go-fastdfs-web
AFFECTED_VERSIONS: Up to 1
---END_METADATA---

Description Summary:
A security vulnerability has been identified in the Perfree go-fastdfs-web application, affecting all versions up to 1.

Executive Summary:
An unpatched security vulnerability in Perfree go-fastdfs-web versions up to 1 presents a significant risk of unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-6105

Affected Software: Perfree, go-fastdfs-web

Affected Versions: Up to 1

Vulnerability: This vulnerability represents a security flaw within the go-fastdfs-web application. While specific technical details are sparse, such flaws in web interfaces frequently involve improper access control or input validation, potentially allowing for unauthenticated interaction with the underlying file system.

Business Impact

The CVSS score of 7.3 indicates a high risk to the availability and integrity of the file storage service. Exploitation could lead to unauthorized file modification, deletion, or administrative control over the storage management interface, resulting in severe operational disruption.

Remediation Plan

Immediate Action: Restrict access to the go-fastdfs-web interface to trusted internal networks and monitor for official vendor patches.

Proactive Monitoring: Review application access logs for unusual administrative activity or unauthorized file access requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict rules to intercept and block abnormal HTTP requests directed at the management interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the lack of a clear patch, organizations should apply strict network-level access controls to isolate the go-fastdfs-web management interface. Continue to monitor the vendor for the release of an update that addresses this vulnerability and apply it as soon as it becomes available.

---METADATA---
VENDOR: CMSJunkie
PRODUCT: WP-BusinessDirectory
AFFECTED_VERSIONS: Up to and including 4.0.1
---END_METADATA---

Description Summary:
The WP-BusinessDirectory plugin for WordPress contains an unauthenticated arbitrary file deletion vulnerability due to insufficient path validation in the upload controller.

Executive Summary:
A critical vulnerability in the WP-BusinessDirectory plugin allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6070

Affected Software: CMSJunkie WP-BusinessDirectory

Affected Versions: Up to and including 4.0.1

Vulnerability: This is an arbitrary file deletion vulnerability caused by improper sanitization of the _filename parameter in the JBusinessDirectoryControllerUpload class. Unauthenticated attackers can leverage path traversal sequences to reach and delete critical system files, such as wp-config.php, via the plugin's frontend routing.

Business Impact

The ability for an unauthenticated attacker to delete critical configuration files poses a severe risk to business continuity and data integrity. With a CVSS score of 9.1, this flaw could result in complete service disruption (denial of service) or allow an attacker to reconfigure the application environment to facilitate further exploitation, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the WP-BusinessDirectory plugin to the latest available version immediately to patch the file deletion logic.

Proactive Monitoring: Review server access logs for suspicious requests targeting task=upload.remove and monitor for unexpected file deletion events or sudden site outages.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../) directed toward the plugin's upload endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this vulnerability and the ease of exploitation, immediate remediation is required. Administrators should prioritize updating the plugin across all affected WordPress installations to prevent unauthorized file deletion and potential server-side compromise.

---METADATA---
VENDOR: Netwide Assembler
PRODUCT: NASM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the NASM disasm() function allows out-of-bounds writes via malicious input.

Executive Summary:
A stack-based buffer overflow in NASM's disassembly functionality could permit arbitrary code execution when processing malicious files.

Vulnerability Details

CVE-ID: CVE-2026-6069

Affected Software: Netwide Assembler NASM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The disasm() function improperly handles memory during disassembly output formatting, leading to a stack-based buffer overflow when the slen parameter exceeds the predefined buffer capacity.

Business Impact

This vulnerability poses a significant risk to the security of systems processing untrusted assembly code. With a CVSS score of 7.5, successful exploitation could lead to arbitrary code execution, potentially granting an attacker full control over the process environment and the ability to execute unauthorized commands.

Remediation Plan

Immediate Action: Update to the latest version of NASM that includes the security fix for the disasm() function.

Proactive Monitoring: Monitor disassembly tools and processes for abnormal termination or memory corruption errors that might suggest exploitation.

Compensating Controls: Employ memory protection mechanisms such as Address Space Layout Randomization (ASLR) and stack canaries if available to mitigate the impact of buffer overflow attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the risks associated with buffer overflows in foundational development tools, immediate remediation is required. Organizations should ensure that all instances of NASM are updated to patched versions to prevent potential code execution attacks.

---METADATA---
VENDOR: Netwide Assembler
PRODUCT: NASM
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A heap buffer overflow in the Netwide Assembler (NASM) obj_directive() function arises from insufficient bounds checking.

Executive Summary:
A heap buffer overflow in NASM could allow an attacker to execute arbitrary code or cause a crash by providing a specially crafted input file.

Vulnerability Details

CVE-ID: CVE-2026-6067

Affected Software: Netwide Assembler NASM

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides in the obj_directive() function, which fails to correctly validate input boundaries, leading to a heap buffer overflow when processing malicious assembler directives.

Business Impact

Exploitation of this heap buffer overflow can result in arbitrary code execution, potentially allowing an attacker to compromise the development or build environment. With a CVSS score of 7.5, this vulnerability is considered a high-risk issue, as it could facilitate the injection of malicious code into compiled binaries, impacting the entire software supply chain.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the NASM project to patch the buffer overflow vulnerability.

Proactive Monitoring: Review build pipeline logs for unexpected crashes or errors during the assembly process which may indicate exploitation attempts.

Compensating Controls: Run the assembler in an isolated, sandboxed environment with restricted network and file system access to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security and development teams should prioritize updating their NASM installations. Failure to patch may expose development environments to malicious code execution, which could have downstream effects on all software projects utilizing the vulnerable assembler.

---METADATA---
VENDOR: FalkorDB
PRODUCT: Browser
AFFECTED_VERSIONS: 1.9.3
---END_METADATA---

Description Summary:
FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API, leading to remote code execution.

Executive Summary:
A critical unauthenticated path traversal vulnerability in FalkorDB Browser allows remote attackers to write arbitrary files and achieve full remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6057

Affected Software: FalkorDB Browser

Affected Versions: 1.9.3

Vulnerability: This is a path traversal vulnerability occurring within the file upload API. It allows remote, unauthenticated attackers to bypass file path restrictions, write malicious files to the server, and execute code.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. It provides an attacker with complete control over the server, risking the exposure of stored databases, system compromise, and potential lateral movement into the broader network environment.

Remediation Plan

Immediate Action: Upgrade FalkorDB Browser to the latest version immediately.

Proactive Monitoring: Audit server file systems for unauthorized or suspicious files created in unexpected directories and review web logs for path traversal patterns.

Compensating Controls: Implement strict file system permissions and use a WAF to filter requests containing directory traversal sequences (e.g., ../).

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to secure the FalkorDB environment. Organizations should prioritize updating the software and restricting administrative access to the file upload API.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setVpnAccountCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary code via manipulated user arguments.

Vulnerability Details

CVE-ID: CVE-2026-6029

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the User argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is severe. Successful exploitation allows for complete takeover of the router, potentially leading to network-wide surveillance or the redirection of traffic to malicious destinations.

Remediation Plan

Immediate Action: Update the firmware of all affected Totolink A7100RU devices to the latest available version.

Proactive Monitoring: Inspect router logs for anomalous entries in the setVpnAccountCfg function and unusual administrative activity.

Compensating Controls: Restrict access to the router's web management interface to trusted internal segments only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

Given the public availability of an exploit, this vulnerability poses an imminent threat. Organizations must prioritize firmware updates to mitigate the risk of remote system control.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setPptpServerCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-6028

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the enable argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is catastrophic. An attacker can gain full control over the networking device, facilitating man-in-the-middle attacks, data interception, and persistence within the local network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to the affected A7100RU devices.

Proactive Monitoring: Monitor network traffic for suspicious cgi-bin activity and unexpected outbound connections from the router.

Compensating Controls: Disable remote management interfaces on the router and ensure it is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

The availability of a public exploit significantly increases the risk of this vulnerability. Administrators must update affected hardware immediately to prevent compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute commands via the enable argument in setUrlFilterRules.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, leading to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6027

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setUrlFilterRules function in /cgi-bin/cstecgi.cgi. An unauthenticated attacker can trigger command injection by manipulating the enable argument.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk. Successful exploitation allows for complete takeover of the router, potentially leading to widespread data interception, unauthorized network access, and the deployment of persistent malware on the device.

Remediation Plan

Immediate Action: Update the device firmware to the latest version to patch the vulnerable CGI handler.

Proactive Monitoring: Maintain vigilance for anomalous device behavior and audit all management interface logs for unauthorized access attempts.

Compensating Controls: Implement network-level segmentation to isolate the management interface and use a WAF to block requests containing malicious command payloads.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. Because this vulnerability is remotely triggerable without authentication, it poses a severe threat to any internet-facing device.

Analyst Recommendation

Immediate action is mandatory to mitigate this critical vulnerability. Administrators should apply the vendor's firmware update as soon as possible and ensure that no vulnerable devices remain exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler, allowing unauthenticated attackers to execute commands via the enable argument in setPortalConfWeChat.

Executive Summary:
A critical remote OS command injection flaw in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, threatening network integrity.

Vulnerability Details

CVE-ID: CVE-2026-6026

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability is located in the setPortalConfWeChat function of the /cgi-bin/cstecgi.cgi component. Unauthenticated remote attackers can perform OS command injection by manipulating the enable argument.

Business Impact

The CVSS score of 9.8 justifies the classification of this vulnerability as critical. Successful exploitation provides attackers with arbitrary code execution capabilities, which can be leveraged to compromise the device, perform man-in-the-middle attacks, or facilitate further unauthorized access to the protected network.

Remediation Plan

Immediate Action: Update the affected Totolink A7100RU devices to the latest firmware provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for suspicious requests to the CGI handler and review device logs for signs of unauthorized configuration changes or command execution.

Compensating Controls: Restrict management interface access to trusted networks and monitor for unauthorized attempts to invoke the vulnerable CGI function.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. The ability for unauthenticated remote attackers to trigger this command injection makes it an urgent security priority.

Analyst Recommendation

Given the critical severity and the existence of public exploits, immediate remediation is required. Organizations should ensure all affected hardware is updated to the latest available firmware to mitigate this high-risk vulnerability.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute arbitrary commands via the enable argument in setSyslogCfg.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router enables unauthenticated attackers to achieve full system execution.

Vulnerability Details

CVE-ID: CVE-2026-6025

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setSyslogCfg function within /cgi-bin/cstecgi.cgi. Unauthenticated attackers can inject operating system commands by manipulating the enable parameter.

Business Impact

A CVSS score of 9.8 reflects the high severity of this command injection flaw. Successful exploitation allows an attacker to bypass authentication, execute arbitrary code, and potentially exfiltrate logs or sensitive configuration data, resulting in a significant security breach and loss of device control.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update to resolve the command injection vulnerability in the CGI handler.

Proactive Monitoring: Inspect system logs for unexpected execution of system commands or unusual traffic patterns associated with the syslog configuration component.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious payloads containing shell metacharacters from requests targeting the CGI interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available for this vulnerability. The ease of triggering this flaw remotely makes it a prime target for automated exploitation tools.

Analyst Recommendation

The risk posed by this vulnerability is critical. Security teams must prioritize patching or isolating the affected A7100RU devices to prevent potential compromise and unauthorized access to the underlying operating system.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated attackers to execute arbitrary system commands via the admpass argument.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-5997

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability resides in the setLoginPasswordCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can trigger OS command injection by manipulating the admpass argument.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to network security. An attacker achieving command injection can modify administrative credentials, reconfigure security settings, or use the device as a persistent beachhead for further attacks, leading to total loss of control over the affected network segment.

Remediation Plan

Immediate Action: Update the device to the latest available firmware version provided by the manufacturer.

Proactive Monitoring: Review system configuration logs for unauthorized changes to administrative accounts or suspicious web requests targeting the CGI handler.

Compensating Controls: Disable remote management features on the router and ensure the device is not accessible from the public internet until the patch is applied.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available, making this a high-risk entry point for attackers. Immediate mitigation is required as the vulnerability allows for unauthenticated remote system command execution.

Analyst Recommendation

Given the critical nature of this flaw and the availability of functional exploits, remediation should be treated as an emergency task. Administrators must ensure all vulnerable units are updated to a secure firmware version to maintain the integrity of the network infrastructure.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler, allowing unauthenticated attackers to execute arbitrary system commands via the tty_server argument.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router poses an immediate risk of full device compromise by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-5996

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located within the setAdvancedInfoShow function of the /cgi-bin/cstecgi.cgi component. The flaw allows an unauthenticated remote attacker to inject malicious commands via the tty_server parameter.

Business Impact

Successful exploitation results in arbitrary code execution with root-level privileges on the network gateway. Given the CVSS score of 9.8, this vulnerability allows for complete system takeover, potential interception of sensitive network traffic, and lateral movement into the internal network, representing a severe risk to organizational data integrity and confidentiality.

Remediation Plan

Immediate Action: Apply the latest vendor-supplied firmware update immediately to patch the vulnerable CGI handler.

Proactive Monitoring: Monitor network traffic for anomalous outbound connections from the gateway and audit system logs for unexpected execution of shell commands.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface to trusted administrative IP addresses only, effectively mitigating remote exploitation attempts.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code for this vulnerability is available, significantly increasing the probability of active exploitation. Organizations must prioritize patching or isolating affected devices from the internet immediately.

Analyst Recommendation

The severity of this flaw, combined with the availability of public exploit material, necessitates an immediate response. Network administrators should verify the firmware version of all Totolink A7100RU devices and apply updates without delay to prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setMiniuiHomeInfoShow function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the lan_info parameter.

Vulnerability Details

CVE-ID: CVE-2026-5995

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi fails to sanitize the lan_info argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 represents a critical risk. Attackers can leverage this to gain full control over the router, potentially compromising all traffic passing through the device.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update.

Proactive Monitoring: Monitor network and device logs for suspicious activity.

Compensating Controls: Restrict device management access to trusted local networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

All Totolink A7100RU devices must be updated immediately to the latest firmware to prevent unauthorized remote command execution and potential system compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setTelnetCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the telnet_enabled parameter.

Vulnerability Details

CVE-ID: CVE-2026-5994

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setTelnetCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the telnet_enabled argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 signifies a critical risk of full device compromise. Attackers can gain root-level access to the router, enabling total control over the device and connected network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink.

Proactive Monitoring: Monitor system logs for unauthorized access or command execution attempts.

Compensating Controls: Disable Telnet and remote management access on the device.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

Update Totolink A7100RU firmware immediately to mitigate this critical command injection vulnerability and prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiGuestCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability Details

CVE-ID: CVE-2026-5993

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 reflects a critical security risk. Exploitation allows for complete takeover of the router, potentially exposing internal network traffic and credentials.

Remediation Plan

Immediate Action: Update to the latest firmware version released by the manufacturer.

Proactive Monitoring: Monitor for unauthorized configuration changes or abnormal system behavior.

Compensating Controls: Restrict management interface access to trusted internal networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available for this vulnerability. The risk of exploitation is high.

Analyst Recommendation

Immediate firmware updates are required to secure Totolink A7100RU devices against this critical command injection flaw.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiAclRules function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the mode parameter.

Vulnerability Details

CVE-ID: CVE-2026-5978

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiAclRules function in /cgi-bin/cstecgi.cgi fails to sanitize the mode argument, allowing remote command injection.

Business Impact

The CVSS score of 9.8 signifies a critical risk. Successful exploitation allows an attacker to seize control of the router, leading to potential data interception and lateral network movement.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update.

Proactive Monitoring: Review system logs for suspicious activity and unauthorized command execution.

Compensating Controls: Disable remote access to the web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

All Totolink A7100RU units must be updated immediately to the latest firmware to prevent unauthorized remote command execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiBasicCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability Details

CVE-ID: CVE-2026-5977

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiBasicCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business Impact

With a CVSS score of 9.8, this flaw allows for total system compromise. Attackers can gain persistent access, manipulate network settings, and compromise the security of all devices connected to the router.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or anomalous traffic patterns.

Compensating Controls: Isolate the management interface from the public internet using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits exist for this vulnerability. The risk of exploitation is high and immediate action is required.

Analyst Recommendation

Immediate firmware updates are required for all Totolink A7100RU units to mitigate this critical command injection risk. Failure to patch leaves the device fully vulnerable to remote takeover.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setStorageCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the sambaEnabled parameter.

Vulnerability Details

CVE-ID: CVE-2026-5976

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setStorageCfg function in /cgi-bin/cstecgi.cgi improperly handles the sambaEnabled argument. An attacker can exploit this to inject and execute arbitrary OS commands remotely.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation grants the attacker full control over the affected hardware, which can be used to exfiltrate data, monitor network traffic, or serve as a launchpad for further network attacks.

Remediation Plan

Immediate Action: Update the device to the latest available firmware provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected execution of shell commands or configuration changes.

Compensating Controls: Restrict access to the device's web management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available and actively being used in the wild. The risk of exploitation is critical.

Analyst Recommendation

Due to the availability of public exploits and the severity of the command injection, immediate firmware updates are required to secure affected Totolink A7100RU devices against remote compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setDmzCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5975

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setDmzCfg function within the /cgi-bin/cstecgi.cgi component fails to sanitize the wanIdx argument. This flaw allows a remote attacker to inject and execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability allows complete device takeover. An attacker can gain persistent access to the router, intercept network traffic, and use the device as a pivot point to attack other systems on the internal network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink for the A7100RU.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempted management interface access from unknown sources.

Compensating Controls: Disable remote management access on the WAN interface and ensure the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits for this vulnerability are available. The risk of exploitation is extremely high, and immediate action is required to secure the device.

Analyst Recommendation

This is a critical vulnerability that allows for full device compromise. Given the availability of public exploits, all affected Totolink A7100RU devices should be updated or isolated from the network immediately to prevent unauthorized access.

---METADATA---
VENDOR: Leantime
PRODUCT: Leantime
AFFECTED_VERSIONS: 0 through 3.4.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that fails to properly validate state parameters.

Executive Summary:
A high-severity Cross-Site Request Forgery (CSRF) vulnerability in Leantime’s OIDC authentication mechanism could allow an attacker to hijack user sessions.

Vulnerability Details

CVE-ID: CVE-2026-59713

Affected Software: Leantime Leantime

Affected Versions: 0 through 3.4.4

Vulnerability: The vulnerability exists in the verifyState() method, which performs unconditional state verification. This allows an unauthenticated attacker to bypass OIDC security controls via a crafted CSRF attack.

Business Impact

The CVSS score of 8.1 highlights a critical risk to user account security. A successful exploit could lead to full account takeover, unauthorized access to sensitive project management data, and potential lateral movement within the application, severely impacting organizational data confidentiality.

Remediation Plan

Immediate Action: Upgrade to the latest version of Leantime provided by the vendor to ensure the OIDC state verification logic is correctly implemented.

Proactive Monitoring: Review authentication logs for suspicious OIDC callback patterns or spikes in login attempts originating from unknown sources.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block suspicious cross-site requests that lack valid state tokens.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using Leantime with OIDC enabled must treat this as a high-priority update. Failure to patch allows for trivial bypass of authentication mechanisms, putting all user accounts at risk of compromise.

---METADATA---
VENDOR: Leantime
PRODUCT: Leantime
AFFECTED_VERSIONS: 0 through 3.4.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The JSON-RPC API in Leantime contains an authorization bypass that allows authenticated users to retrieve sensitive credential information from other accounts.

Executive Summary:
A critical authorization bypass in the Leantime JSON-RPC API allows authenticated users to exfiltrate password hashes, TOTP secrets, and session tokens.

Vulnerability Details

CVE-ID: CVE-2026-59712

Affected Software: Leantime Leantime

Affected Versions: 0 through 3.4.4

Vulnerability: The Users::getUser method lacks necessary authorization checks (CWE-639), enabling an authenticated user to perform unauthorized lookups of sensitive user credential rows. This allows an attacker with standard user privileges to gain access to highly sensitive security data of other users.

Business Impact

This vulnerability carries a CVSS score of 8.1, reflecting the significant risk of full account takeover. Unauthorized access to password hashes, multi-factor authentication secrets, and session tokens effectively invalidates the security posture of the entire platform, potentially leading to widespread compromise of user accounts and administrative access.

Remediation Plan

Immediate Action: Update to the patched version of Leantime provided by the vendor.

Proactive Monitoring: Review audit logs for anomalous or high-frequency calls to the Users::getUser JSON-RPC method, particularly those requesting data for multiple distinct user IDs.

Compensating Controls: Restrict API access to trusted network segments and ensure robust logging is enabled for all JSON-RPC interface interactions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the exposure of sensitive authentication material, this vulnerability must be treated as a critical security priority. Organizations should apply the vendor-supplied security update immediately to prevent credential harvesting and potential lateral movement across the platform.