Junglewise Threat Intelligence

CVE-2026-5691: Totolink A7100RU command injection in setFirewallType

CVE-2026-5691 · Severity: high · CVSS 7.3 · Published 2026-04-06

Technologies: TOTOLINK A7100ru. Vendors: TOTOLINK.

Executive brief

A security vulnerability exists in the Totolink A7100RU home router. This flaw allows a remote attacker to take control of the device by sending a specially crafted request to the router's management interface. Successful exploitation could lead to unauthorized access to the network, interception of data, or a complete shutdown of the device's internet services.

Technical details

An OS command injection vulnerability exists in the /cgi-bin/cstecgi.cgi component of the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024). The vulnerability is located within the setFirewallType function (specifically sub_42DA2C), where the 'firewallType' parameter is improperly sanitized before being passed to the CsteSystem function and subsequently executed via execv(). A remote, unauthenticated attacker can exploit this by sending a crafted JSON POST request containing shell metacharacters (e.g., backticks) to execute arbitrary commands with system privileges. A public Proof of Concept (PoC) demonstrating the use of 'wget' via this vector has been disclosed.

Affected products

  • Totolink A7100RU 7.4cu.2313_b20191024

Timeline

  • 2026-04-06: disclosed: Vulnerability and PoC publicly disclosed via GitHub and VulDB.
  • 2026-04-06: advisory: CVE-2026-5691 published.

References

Related threats