Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router
Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Apr 9, 2026
Two critical vulnerabilities, CVE-2026-5851 and CVE-2026-5976, were disclosed in the Totolink A7100RU router running firmware 7.4cu.2313_b20191024, exposing the device to remote OS command injection without authentication or user interaction. Both flaws affect /cgi-bin/cstecgi.cgi in the router's CGI handler: CVE-2026-5851 is tied to the setUPnPCfg function through the enable argument, while CVE-2026-5976 affects the setStorageCfg function through the sambaEnabled argument.
The vulnerabilities were classified under CWE-78 and CWE-77 and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to VulDB and a GitHub disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
