CVE-2026-5692
Published: 07 April 2026
Summary
CVE-2026-5692 is a medium-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability exists in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setGameSpeedCfg function of the /cgi-bin/cstecgi.cgi file, where improper handling of the enable argument permits OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 6.9.
Remote unauthenticated attackers can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands. Successful exploitation yields limited effects on confidentiality, integrity, and availability of the device. A proof-of-concept exploit has been published publicly.
The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.0486, indicating increased exploitation interest after disclosure. Public references include a detailed proof-of-concept repository and multiple Vuldb entries, while the vendor site provides no additional advisory information in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19557
Vulnerability details
A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setGameSpeedCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be performed from remote. The exploit has been made…
more
public and could be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing CGI script directly enables T1190 for remote exploitation of the web interface and T1059.004 for arbitrary Unix shell command execution on the Linux-based firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the OS command injection vulnerability in the Totolink A7100RU firmware by requiring timely identification, reporting, and patching of the flaw in /cgi-bin/cstecgi.cgi.
Prevents command injection exploitation by validating the 'enable' argument in the setGameSpeedCfg function against expected formats to block malicious OS commands.
Mitigates remote unauthenticated access to the vulnerable CGI endpoint by monitoring and controlling communications at external system boundaries.