CVE-2026-5678
Published: 06 April 2026
Summary
CVE-2026-5678 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A weakness has been identified in the Totolink A7100RU router running firmware 7.4cu.2313_b20191024. The issue resides in the setScheduleCfg function within /cgi-bin/cstecgi.cgi, where improper handling of the mode argument permits OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9, reflecting network attackability without authentication or user interaction.
Remote, unauthenticated attackers can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants limited control over confidentiality, integrity, and availability of the router, with a publicly available proof-of-concept that lowers the barrier for malicious use.
Public references include a detailed vulnerability report and exploit on GitHub, entries on Vuldb, and the vendor’s site, yet none of the listed sources describe patches, firmware updates, or specific mitigation steps. The EPSS score remains low, with a current value of 0.0474 and a peak of 0.0486, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19462
Vulnerability details
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument mode can lead to os command injection. The attack may be launched remotely. The…
more
exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing router CGI enables T1190 for initial access via public-facing app exploitation and directly facilitates T1059.004 for Unix shell command execution on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating and sanitizing untrusted inputs like the 'mode' argument in the vulnerable setScheduleCfg CGI function.
Mitigates the vulnerability through timely flaw remediation by applying Totolink firmware patches that fix the command injection in cstecgi.cgi.
Prevents command injection by restricting the 'mode' parameter to whitelisted values, lengths, or formats in the affected CGI endpoint.