Loading vulnerability…
OS Command Injection in Totolink A7100RU setVpnPassCfg
CVE-2026-5850 is an OS command injection vulnerability affecting Totolink A7100RU firmware version 7.4cu.2313_b20191024. The flaw is present in the setVpnPassCfg function exposed through /cgi-bin/cstecgi.cgi in the CGI Handler component. According to the provided content, improper handling of the pptpPassThru argument allows attacker-controlled input to be incorporated into operating system command execution. The issue is remotely exploitable, and a public exploit is available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary operating system commands on the affected device. Based on the provided CVSS information and description, this can result in full compromise of the router, including unauthorized access to device data, modification of configuration or system state, and disruption of device availability.
If you can’t patch tonight, do this now.
If no fixed firmware is available, restrict network access to the affected CGI interface, especially /cgi-bin/cstecgi.cgi, to trusted administrative networks only. Disable remote administration and any unnecessary WAN-side exposure. Apply network segmentation and ACLs to prevent untrusted hosts from reaching the management interface. Monitor for suspicious requests targeting setVpnPassCfg or containing crafted pptpPassThru values, and consider replacing or isolating affected devices until a patch is available.
Patch, then assume compromise.
Upgrade Totolink A7100RU firmware to a vendor-fixed version if one is available. The vulnerable code path in setVpnPassCfg should be corrected so that the pptpPassThru parameter is not passed into shell command execution in an unsafe manner. Remediation should include eliminating shell invocation where possible, using strict allowlisting for expected values, and properly separating command arguments from user-controlled input.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.