CVE-2026-5993

Totolink · A7100RU

The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiGuestCfg function, allowing remote attackers to execute arbitrary commands.

Executive summary

A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability

The setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business impact

The CVSS score of 9.8 reflects a critical security risk. Exploitation allows for complete takeover of the router, potentially exposing internal network traffic and credentials.

Remediation

Immediate Action: Update to the latest firmware version released by the manufacturer.

Proactive Monitoring: Monitor for unauthorized configuration changes or abnormal system behavior.

Compensating Controls: Restrict management interface access to trusted internal networks.

Exploitation status

Public Exploit Available: Yes

Analyst recommendation

Immediate firmware updates are required to secure Totolink A7100RU devices against this critical command injection flaw.