Cyber Resilience

CVE-2026-5691

Medium

Published: 06 April 2026

Published
06 April 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0474 89.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5691 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

A vulnerability identified as CVE-2026-5691 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It exists in the setFirewallType function of the /cgi-bin/cstecgi.cgi file, where unsanitized input to the firewallType argument permits OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9.

The flaw can be triggered remotely by unauthenticated attackers who supply crafted values to the affected parameter, resulting in arbitrary command execution on the device with limited impacts to confidentiality, integrity, and availability.

Publicly available references include a detailed proof-of-concept on GitHub along with entries on VulDB, but no vendor advisory or patch information is provided in the listed sources. The EPSS score remains low at a current value of 0.0474 with a peak of 0.0486.

EU & UK References

Vulnerability details

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setFirewallType of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument firewallType leads to os command injection. The attack is possible to be carried out remotely. The exploit…

more

has been disclosed to the public and may be used.

CWE(s)
CWE-77CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in public-facing CGI script enables unauthenticated remote command execution on Linux-based router, directly mapping to T1190 for exploitation of public-facing app and T1059.004 for Unix shell command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-9454Shared CWE-77, CWE-78
CVE-2026-6116Shared CWE-77, CWE-78
CVE-2026-6158Shared CWE-77, CWE-78
CVE-2026-7138Shared CWE-77, CWE-78
CVE-2025-9387Shared CWE-77, CWE-78
CVE-2025-15472Shared CWE-77, CWE-78
CVE-2026-2260Shared CWE-77, CWE-78
CVE-2026-9385Shared CWE-77, CWE-78
CVE-2026-4465Shared CWE-77, CWE-78
CVE-2026-7125Shared CWE-77, CWE-78

Affected Assets

Totolink
A7100RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by validating the firewallType argument in the setFirewallType function of the CGI script.

SI-2 Flaw Remediation good match
prevent

Remediates the specific vulnerability in the Totolink A7100RU firmware by identifying, prioritizing, and applying patches to eliminate the command injection flaw.

AC-3 Access Enforcement partial match
prevent

Enforces logical access controls on the /cgi-bin/cstecgi.cgi endpoint to block unauthenticated remote attackers from reaching and exploiting the vulnerable function.

References