CVE-2026-5978
Published: 09 April 2026
Summary
CVE-2026-5978 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A security vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The issue resides in the setWiFiAclRules function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component, where improper handling of the mode argument enables OS command injection. The flaw is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9, reflecting network-accessible attack vectors with no required authentication or user interaction.
Unauthenticated remote attackers can supply crafted input to the affected CGI endpoint to execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, allowing actions such as configuration changes, traffic interception, or persistence mechanisms. Public exploit code has already been released.
The listed references include a detailed disclosure on GitHub along with VulDB entries and the vendor site, though no specific patch or mitigation guidance is described in the available data. The associated EPSS score remains low, with a current value of 0.0122 and a peak of 0.0125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21185
Vulnerability details
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command injection. The attack can be initiated…
more
remotely. The exploit has been disclosed publicly and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in a public-facing CGI interface on a router, directly enabling exploitation of public-facing applications (T1190) and arbitrary OS command execution via network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the untrusted 'mode' argument passed to setWiFiAclRules, blocking the OS command injection vector at the CGI handler.
Enforces access-control policy on the /cgi-bin/cstecgi.cgi endpoint so that unauthenticated remote callers cannot invoke setWiFiAclRules at all.
Boundary-protection mechanisms can restrict or deny network access to the router's management CGI interface from untrusted external networks.