Executive brief
A security vulnerability exists in the Totolink A7100RU wireless router, a device used to provide internet connectivity and manage local networks. An attacker can exploit this flaw to take complete control of the router by executing unauthorized commands remotely. This could lead to the interception of network traffic, disruption of internet services, or unauthorized access to other devices on the home or office network.
Technical details
An OS command injection vulnerability exists in the Totolink A7100RU router (firmware version 7.4cu.2313_b20191024) within the 'setAdvancedInfoShow' function of the '/cgi-bin/cstecgi.cgi' component. The root cause is the improper neutralization of the 'tty_server' parameter, which is passed to the 'Uci_Set_Str' function and subsequently executed via 'execv()' through the 'CsteSystem' function. A remote, unauthenticated attacker can exploit this by sending a crafted HTTP POST request containing shell metacharacters in the JSON payload. Successful exploitation allows for arbitrary command execution with the privileges of the CGI handler, potentially leading to full device takeover. Public exploit code (PoC) has been disclosed.
Affected products
- Totolink A7100RU 7.4cu.2313_b20191024
Timeline
- 2026-04-09: disclosed: Vulnerability details and PoC published on GitHub
- 2026-04-10: advisory: CVE-2026-5996 published in NVD