CVE-2026-5678
OS Command Injection in Totolink A7100RU setScheduleCfg Function
Publication date: 2026-04-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313_b20191024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A7100RU router. This can lead to unauthorized access, data breaches, and potential compromise of sensitive information.
Such security weaknesses can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
Exploitation of this vulnerability could result in exposure or manipulation of protected data, thereby violating requirements for data confidentiality, integrity, and security mandated by these regulations.
Can you explain this vulnerability to me?
CVE-2026-5678 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It exists in the function setScheduleCfg within the /cgi-bin/cstecgi.cgi script, specifically in how it processes the "mode" parameter.
An attacker can manipulate the "mode" argument to inject arbitrary operating system commands. The vulnerability occurs because the input is formatted into a buffer and then executed via a system call without proper sanitization.
This allows remote attackers to execute arbitrary OS commands on the device by sending specially crafted POST requests to the router's CGI interface.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected TOTOLINK A7100RU router.
- Attackers could take control of the router remotely.
- They could manipulate network traffic or disrupt network services.
- It could be used as a foothold to launch further attacks within the network.
- Sensitive information could be exposed or altered.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for specially crafted POST requests sent to the /cgi-bin/cstecgi.cgi endpoint on the TOTOLINK A7100RU router. These requests contain a JSON body with the "mode" parameter set to suspicious or arbitrary OS commands.
A detection method involves capturing HTTP traffic and searching for POST requests to /cgi-bin/cstecgi.cgi with payloads containing the "mode" parameter.
- Use network traffic analysis tools like tcpdump or Wireshark to capture HTTP POST requests targeting /cgi-bin/cstecgi.cgi.
- Example tcpdump command to capture relevant HTTP POST requests: tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /cgi-bin/cstecgi.cgi'
- Inspect captured HTTP POST bodies for JSON containing the "mode" parameter with suspicious command injection patterns, such as commands starting with wget or other OS commands.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected router's management interface to trusted networks only, such as local LAN, and disabling remote management if enabled.
Additionally, monitor and block suspicious HTTP POST requests targeting /cgi-bin/cstecgi.cgi, especially those containing the "mode" parameter.
If possible, update the router firmware to a version that patches this vulnerability or apply vendor-provided security updates.
As a temporary workaround, consider implementing firewall rules to block incoming traffic to the /cgi-bin/cstecgi.cgi endpoint or disable the CGI functionality if not required.