Loading vulnerability…
OS Command Injection in Totolink A7100RU setWiFiEasyCfg
CVE-2026-5854 is an OS command injection vulnerability affecting Totolink A7100RU firmware version 7.4cu.2313_b20191024. The flaw is in the setWiFiEasyCfg function exposed through /cgi-bin/cstecgi.cgi in the CGI Handler component. According to the provided content, an attacker can manipulate the merge argument, causing unsanitized input to be incorporated into operating system command execution. The issue is remotely exploitable and public exploit code is available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote attacker to execute arbitrary operating system commands on the affected device. Based on the provided severity context, this can result in full compromise of the router, including loss of confidentiality, integrity, and availability, such as unauthorized access to device data and configuration, modification of system state, and service disruption.
If you can’t patch tonight, do this now.
Until a fixed firmware version is confirmed, restrict remote access to the router's administrative and CGI interfaces, especially /cgi-bin/cstecgi.cgi, to trusted management networks only. Disable WAN-side administration if enabled, enforce network segmentation, and use firewall or ACL controls to prevent untrusted hosts from reaching the management plane. Monitor for suspicious requests targeting setWiFiEasyCfg or the merge parameter, and replace or isolate affected devices if exposure cannot be reduced.
Patch, then assume compromise.
Upgrade Totolink A7100RU devices to a vendor-fixed firmware release if one is available. Because the provided content identifies the vulnerable version as 7.4cu.2313_b20191024 but does not specify a patched version, the exact fixed release is currently not available from the supplied information. Review vendor advisories from Totolink and apply the latest supported firmware addressing CVE-2026-5854.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.