Loading vulnerability…
OS Command Injection in Totolink A7100RU setUPnPCfg
CVE-2026-5851 is a remote OS command injection vulnerability affecting Totolink A7100RU firmware version 7.4cu.2313_b20191024. The flaw is present in the setUPnPCfg function exposed through /cgi-bin/cstecgi.cgi in the device's CGI Handler. According to the provided content, manipulation of the enable argument is not properly sanitized before being used in a system-level command context, allowing attacker-controlled input to trigger command execution on the underlying operating system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow a remote attacker to execute arbitrary OS commands on the affected router. Given the provided CVSS assessments (C:H/I:H/A:H), impact can include full compromise of device confidentiality, integrity, and availability, including unauthorized configuration changes, disruption of routing or network services, and potential use of the device as a foothold for further network activity. Public exploit availability increases the likelihood of opportunistic exploitation.
If you can’t patch tonight, do this now.
Restrict network access to the router's administrative/CGI interface so /cgi-bin/cstecgi.cgi is not reachable from untrusted networks, especially the Internet. Disable remote administration if not required, place management access behind trusted internal networks only, and use firewall or ACL controls to limit access to authorized hosts. Monitor for suspicious requests targeting setUPnPCfg or the enable parameter, and consider disabling UPnP-related management exposure where operationally feasible until a fixed firmware release is applied.
Patch, then assume compromise.
Upgrade to a vendor-fixed firmware version if one is available from Totolink. Because the issue is tied to improper handling of the enable parameter in setUPnPCfg within /cgi-bin/cstecgi.cgi, remediation should include vendor code changes that eliminate shell invocation with unsanitized input, implement strict server-side input validation, and use safe APIs that avoid command-shell interpretation. If no patched firmware is available, the information currently available does not provide a vendor-specified fix version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.