CVE-2026-5975
Published: 09 April 2026
Summary
CVE-2026-5975 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
A vulnerability identified as CVE-2026-5975 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setDmzCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the wanIdx argument enables OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9.
An unauthenticated attacker can exploit the flaw remotely by sending a crafted request to the affected CGI endpoint. Successful exploitation grants the ability to execute arbitrary operating system commands on the device. A publicly available exploit has been disclosed that demonstrates this vector.
The provided references include a detailed proof-of-concept on GitHub, multiple VulDB entries, and the vendor site, but contain no specific mitigation guidance or patch information. The associated EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21074
Vulnerability details
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command injection. The attack may be performed…
more
from remote. The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote OS command injection via public-facing router web CGI directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the wanIdx argument in setDmzCfg to block OS command injection via the unauthenticated CGI endpoint.
Enforces access-control policy on /cgi-bin/cstecgi.cgi so that unauthenticated remote requests cannot reach the vulnerable setDmzCfg function.
Limits privileges of the CGI process so that even a successful wanIdx injection yields only minimal OS-level impact on the router.