Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection_CVE-2026-5851

9.3 / 10

CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Description

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Basic Information

ID CVE-2026-5851

Source VulDB

Published Apr 9, 2026 at 06:00

Modified Apr 9, 2026 at 12:13

Affected Product

Vendor Totolink

Product A7100RU

Version 7.4cu.2313_b20191024

Affected Versions Totolink A7100RU 7.4cu.2313_b20191024

CWE Classification

CWE-78 CWE-77

References

{
    "lastseen": "",
    "description": "A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.",
    "published": "2026-04-09T06:00:16.723Z",
    "modified": "2026-04-09T12:13:58.251Z",
    "type": "cve",
    "title": "Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/356377\nhttps://vuldb.com/vuln/356377/cti\nhttps://vuldb.com/submit/791271\nhttps://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_157/README.md\nhttps://www.totolink.net/",
    "id": "CVE-2026-5851",
    "bulletinFamily": "",
    "cwe": [
        "CWE-78",
        "CWE-77"
    ],
    "cvelist": null,
    "sourceData": "Totolink A7100RU 7.4cu.2313_b20191024",
    "sourceHref": "",
    "cvss": {
        "score": 9.3,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "A7100RU",
    "version": "7.4cu.2313_b20191024",
    "vendor": "Totolink",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}