CVE-2026-5993
Published: 10 April 2026
Summary
CVE-2026-5993 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
A vulnerability has been identified in the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setWiFiGuestCfg function of the /cgi-bin/cstecgi.cgi file within the CGI Handler component, where improper handling of the wifiOff argument permits OS command injection. The issue is tracked under CWE-77 and CWE-78 and carries a CVSS 4.0 score of 8.9 reflecting network-accessible attack conditions without authentication or user interaction.
An unauthenticated remote attacker can supply a crafted request to the affected CGI endpoint and execute arbitrary operating system commands on the device. Public exploit code is available, enabling potential outcomes such as device takeover, configuration changes, or use as a pivot point into attached networks.
The EPSS score remains low and essentially flat at a current value of 0.0122 against a recorded peak of 0.0125, indicating limited observed exploitation interest to date. No vendor advisory or patch information is provided in the available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21268
Vulnerability details
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed remotely.…
more
The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in a public-facing CGI endpoint on a router, directly enabling exploitation of public-facing applications (T1190) and arbitrary OS command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Strict validation and sanitization of the wifiOff argument in setWiFiGuestCfg would directly block the OS command injection payload.
Access enforcement would require authentication and authorization before any request reaches the unauthenticated CGI handler.
Boundary protection can restrict remote, unauthenticated access to the management CGI endpoint from untrusted networks.