CVE-2026-5997

CRITICAL CVSS 9.8 View on NVD ↗

Description

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_169/README.md
https://vuldb.com/submit/792045
https://vuldb.com/vuln/356551
https://vuldb.com/vuln/356551/cti
https://www.totolink.net/

Published: Apr 10, 2026 02:16 UTC Modified: Apr 10, 2026 02:16 UTC