CVE-2026-5976

CRITICAL CVSS 9.8 View on NVD ↗

Description

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_162/README.md
https://vuldb.com/submit/791822
https://vuldb.com/vuln/356530
https://vuldb.com/vuln/356530/cti
https://www.totolink.net/

Published: Apr 09, 2026 20:16 UTC Modified: Apr 09, 2026 20:16 UTC