embedded-device-vulnerabilityproof-of-concept-release

Critical Command Injection Flaws Expose Totolink A7100RU Routers to RCE

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 9, 2026

Two newly disclosed vulnerabilities, CVE-2026-5854 and CVE-2026-5977, affect the Totolink A7100RU router running firmware 7.4cu.2313_b20191024 and allow remote command execution without authentication or user interaction. Both flaws are in the router’s CGI handler at /cgi-bin/cstecgi.cgi: CVE-2026-5854 is tied to the setWiFiEasyCfg function through the merge argument, while CVE-2026-5977 affects setWiFiBasicCfg through the wifiOff argument.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Apr 9, 2026 – Apr 10, 2026

Apr 10, 20267mo ago
Third Totolink A7100RU command injection flaw is disclosed as CVE-2026-5993
On 2026-04-10, CVE-2026-5993 was received for Totolink A7100RU firmware 7.4cu.2313_b20191024. The flaw affects the setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi and allows remote OS command injection via the wifiOff argument without privileges or user interaction; public exploit information was noted.
CVE-2026-5993 - Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection
Apr 9, 20267mo ago
Two command injection flaws in Totolink A7100RU are disclosed as CVEs
On April 9, 2026, CVE-2026-5854 and CVE-2026-5977 were recorded for Totolink A7100RU firmware 7.4cu.2313_b20191024. The flaws affect the setWiFiEasyCfg and setWiFiBasicCfg functions in /cgi-bin/cstecgi.cgi and allow remote OS command injection without privileges or user interaction; public exploit information was noted.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

OS Command Injection in Totolink A7100RU setWiFiEasyCfg (CVE-2026-5854)OS Command Injection in Totolink A7100RU setWiFiBasicCfg (CVE-2026-5977)

Affected products

1 linked

A7100ru

Organizations

1 linked

Totolink

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Apr 10, 2026

CVE-2026-5993 - Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injectionOpen source ↗

Cvefeed High SeverityAdvisories · Apr 9, 2026

CVE-2026-5854 - Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injectionOpen source ↗

Cvefeed High SeverityAdvisories · Apr 9, 2026

CVE-2026-5977 - Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injectionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Command Injection Flaws Expose Totolink A7100RU Routers to RCE

How this story unfolded

Third Totolink A7100RU command injection flaw is disclosed as CVE-2026-5993

Two command injection flaws in Totolink A7100RU are disclosed as CVEs

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU and A8000RU Routers

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE

Critical Command Injection Flaws Expose Totolink A7100RU Routers to RCE

How this story unfolded

Third Totolink A7100RU command injection flaw is disclosed as CVE-2026-5993

Two command injection flaws in Totolink A7100RU are disclosed as CVEs

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU and A8000RU Routers

Unauthenticated Command Injection Flaws Disclosed in Totolink A7100RU Router

Critical Command Injection Flaws Expose Totolink A8000RU Routers to Remote RCE