CVE-2026-5689
Published: 06 April 2026
Summary
CVE-2026-5689 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability was detected in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setNtpCfg function within /cgi-bin/cstecgi.cgi, where improper handling of the tz argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9, reflecting network-accessible attack vectors with low complexity.
Remote unauthenticated attackers can supply crafted input to the tz parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants limited control over confidentiality, integrity, and availability of the affected router, and a public exploit is already available.
Reference materials hosted on Vuldb and a GitHub repository document the vulnerability details and proof-of-concept, while the vendor site at totolink.net provides general product information but no explicit patch or mitigation guidance in the available sources.
The EPSS score has risen from a low baseline to a recorded peak of 0.0486, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19551
Vulnerability details
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument tz results in os command injection. Remote exploitation of the attack is possible. The exploit…
more
is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing CGI web interface enables remote exploitation of the application (T1190) and direct execution of arbitrary commands via Unix shell on the Linux-based router firmware (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating the tz argument in setNtpCfg to reject malformed inputs containing command separators or executables.
Enforces restrictions on the tz parameter to block invalid or malicious inputs that could enable command injection in the CGI script.
Remediates the specific flaw in /cgi-bin/cstecgi.cgi by applying firmware patches or updates from the vendor to eliminate the vulnerability.