CVE-2026-5850
Published: 09 April 2026
Summary
CVE-2026-5850 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability identified as CVE-2026-5850 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setVpnPassCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component. Manipulation of the pptpPassThru argument enables OS command injection, corresponding to CWE-77 and CWE-78, with a CVSS 4.0 score of 8.9 reflecting network-accessible, low-complexity attack conditions that can fully compromise confidentiality, integrity, and availability.
Remote unauthenticated attackers can exploit the flaw over the network to inject and execute arbitrary operating system commands. The attack requires no user interaction or privileges, and a publicly available exploit increases the likelihood of successful remote code execution on affected devices.
Reference URLs include a GitHub repository containing vulnerability details, multiple Vuldb entries, and the vendor site, though no specific mitigation guidance or patch information is described in the available references. The EPSS score rose from a low starting value of 0.0037 to a peak of 0.0125, indicating that exploitation interest emerged after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20862
Vulnerability details
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible.…
more
The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (T1190) leading to OS command injection on Unix-based router firmware (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks OS command injection by requiring validation and sanitization of the pptpPassThru argument before it reaches setVpnPassCfg in cstecgi.cgi.
Enforces access restrictions on the CGI handler so that unauthenticated remote callers cannot invoke setVpnPassCfg at all.
Boundary-protection mechanisms such as WAF rules or interface ACLs can filter malicious pptpPassThru payloads before they reach the vulnerable CGI endpoint.