Cyber Resilience

CVE-2026-5997

HighRCE

Published: 10 April 2026

Published
10 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score v4 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0180 75.7th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-5997 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A7100RU (inferred from references). Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

A vulnerability identified as CVE-2026-5997 affects the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. It resides in the setLoginPasswordCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component. Manipulation of the admpass argument enables OS command injection, corresponding to CWE-77 and CWE-78, and the flaw can be triggered remotely without authentication.

An attacker with network access can supply crafted input to the affected CGI endpoint and execute arbitrary operating system commands on the device. Successful exploitation grants full control over confidentiality, integrity, and availability of the router, consistent with the CVSS 8.9 rating. The exploit code has been made public and is available for use.

The EPSS score remains low, moving only from 0.0122 to a peak of 0.0125 with no material increase after disclosure. Public references include a detailed proof-of-concept repository and entries on VulDB, while the vendor site provides no additional mitigation guidance in the supplied data.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection. It is possible to launch…

more

the attack remotely. The exploit is now public and may be used.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

The vulnerability is a remote unauthenticated OS command injection in a public-facing web CGI interface on a router, directly enabling T1190 (Exploit Public-Facing Application) and facilitating arbitrary command execution matching T1059.008 (Network Device CLI).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-7123Shared CWE-77, CWE-78
CVE-2026-6114Shared CWE-77, CWE-78
CVE-2026-2082Shared CWE-77, CWE-78
CVE-2025-15254Shared CWE-77, CWE-78
CVE-2025-1819Shared CWE-77, CWE-78
CVE-2026-7243Shared CWE-77, CWE-78
CVE-2026-1506Shared CWE-77, CWE-78
CVE-2026-3696Shared CWE-77, CWE-78
CVE-2026-6154Shared CWE-77, CWE-78
CVE-2026-4627Shared CWE-77, CWE-78

Affected Assets

Totolink
A7100RU
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of the admpass argument supplied to setLoginPasswordCfg, blocking the OS command injection vector.

prevent

Enforces authentication and authorization checks before any CGI request reaches the vulnerable setLoginPasswordCfg function, eliminating the unauthenticated remote attack path.

prevent

Restricts network access to the router's management CGI endpoints, limiting the remote attack surface that enables exploitation of CVE-2026-5997.

References