CVE-2026-5977
Published: 09 April 2026
Summary
CVE-2026-5977 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A weakness has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setWiFiBasicCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. Manipulation of the wifiOff argument allows an attacker to inject operating system commands, corresponding to CWE-77 and CWE-78. The vulnerability is remotely exploitable without authentication and carries a CVSS 4.0 score of 8.9.
An unauthenticated remote attacker can send a crafted HTTP request to the CGI endpoint to execute arbitrary commands on the device. Successful exploitation grants full control over the router, enabling actions such as altering network settings, intercepting traffic, or using the device as a pivot point. A public exploit for this flaw has been released.
The EPSS score remains low, moving only from 0.0122 currently to a peak of 0.0125, indicating limited observed exploitation interest to date. Reference materials point to detailed vulnerability descriptions on VulDB and a proof-of-concept repository, along with the vendor site, though no specific patch or mitigation guidance is detailed in the available sources.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21184
Vulnerability details
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os command injection. It is possible to…
more
launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable OS command injection in a public-facing web CGI interface on a router (T1190), directly enabling arbitrary command execution via network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the wifiOff argument in setWiFiBasicCfg to block OS command injection via the CGI endpoint.
Enforces access control so that unauthenticated remote requests to /cgi-bin/cstecgi.cgi are denied before the vulnerable function can be reached.
Boundary protection mechanisms such as interface restrictions or WAF rules can block crafted HTTP requests targeting the exposed CGI handler from untrusted networks.