CVE-2026-5690
Published: 06 April 2026
Summary
CVE-2026-5690 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates OS command injection by validating and sanitizing the 'enable' argument in the vulnerable setRemoteCfg function.
Addresses the root cause by requiring timely remediation of the known command injection flaw through firmware patching.
Prevents remote exploitation of the unauthenticated CGI endpoint by enforcing boundary protections on network interfaces.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing CGI web interface on router enables remote unauthenticated exploitation of the application (T1190) and direct arbitrary command execution via Unix shell (T1059.004).
NVD Description
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setRemoteCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument enable can lead to os command injection. The attack can be executed remotely. The…
more
exploit has been published and may be used.
Deeper analysisAI
CVE-2026-5690 is an OS command injection vulnerability (CWE-77, CWE-78) affecting the Totolink A7100RU router on firmware version 7.4cu.2313_b20191024. The flaw resides in the setRemoteCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the "enable" argument enables attackers to inject and execute arbitrary operating system commands.
The vulnerability is remotely exploitable over the network by unauthenticated attackers requiring low attack complexity and no user interaction, earning a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Exploitation allows limited impacts on confidentiality, integrity, and availability, with a published exploit available for use.
References include a GitHub repository at https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_188/README.md detailing the exploit, VULDB advisories at https://vuldb.com/vuln/355517 and related pages, and the vendor site at https://www.totolink.net/. The exploit has been published and may be used in attacks.
Details
- CWE(s)