CVE-2026-5690
Published: 06 April 2026
Summary
CVE-2026-5690 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A flaw has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setRemoteCfg function within /cgi-bin/cstecgi.cgi, where improper handling of the enable argument permits OS command injection. The vulnerability is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9, reflecting network-accessible attack conditions with low complexity.
Unauthenticated remote attackers can supply crafted input to the affected parameter and execute arbitrary operating-system commands on the device. Successful exploitation grants limited control over confidentiality, integrity, and availability of the router without requiring user interaction or elevated privileges. Publicly available exploit code increases the likelihood of automated or targeted attacks against exposed devices.
Vendor advisories and patch information are not detailed in the referenced sources, which primarily consist of a GitHub repository containing vulnerability details, multiple Vuldb entries, and the Totolink support site. Administrators should monitor the vendor for firmware updates addressing the cstecgi.cgi component.
EPSS probability rose from a low baseline to a recorded peak of 0.0486 before settling at the current value of 0.0115, indicating that exploitation interest increased after public disclosure. The published exploit further underscores the need for renewed attention to unpatched A7100RU deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19553
Vulnerability details
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The…
more
exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing CGI web interface on router enables remote unauthenticated exploitation of the application (T1190) and direct arbitrary command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates OS command injection by validating and sanitizing the 'enable' argument in the vulnerable setRemoteCfg function.
Addresses the root cause by requiring timely remediation of the known command injection flaw through firmware patching.
Prevents remote exploitation of the unauthenticated CGI endpoint by enforcing boundary protections on network interfaces.