CVE-2026-5852
Published: 09 April 2026
Summary
CVE-2026-5852 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A weakness has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setIptvCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. Manipulation of the igmpVer argument allows an attacker to inject operating system commands, corresponding to CWE-77 and CWE-78. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9.
An unauthenticated remote attacker can send a crafted HTTP request to the CGI endpoint to execute arbitrary commands on the device. Successful exploitation grants full control over the router, enabling actions such as altering network configuration, intercepting traffic, or using the device as a pivot point. A public exploit for this flaw has been released.
The current EPSS score stands at 0.0123 with a recorded peak of 0.0125, indicating limited observed exploitation interest. References point to detailed vulnerability reports on VulDB and a GitHub repository containing proof-of-concept material, along with the vendor's site, though no specific mitigation guidance is provided in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20866
Vulnerability details
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried…
more
out remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable OS command injection in a public-facing router CGI interface (T1190), directly enabling arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all inputs (including igmpVer) to the CGI endpoint, blocking the OS command injection vector.
Enforces access-control policy so that unauthenticated remote requests to setIptvCfg are rejected before any command processing occurs.
Requires timely application of vendor patches or firmware updates that eliminate the setIptvCfg command-injection flaw.