PT-2026-31724

CVE-2026-5976

Published

2026-04-09

Updated

2026-04-13

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024

Description A security issue exists in Totolink A7100RU 7.4cu.2313 b20191024. The setStorageCfg function within the /cgi-bin/cstecgi.cgi file of the CGI Handler component is susceptible to os command injection through manipulation of the sambaEnabled argument. This allows for remote attacks. The exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

Ltzhuster2

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')