CVE-2026-5691: Totolink A7100RU RCE Vulnerability

CVE-2026-5691 Overview

CVE-2026-5691 is an OS command injection vulnerability affecting the Totolink A7100RU router running firmware version 7.4cu.2313_b20191024. The flaw resides in the setFirewallType function within the /cgi-bin/cstecgi.cgi binary. Attackers can manipulate the firewallType argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public disclosure of the exploit details has occurred, increasing the likelihood of opportunistic attacks against exposed devices. The weakness is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact

Unauthenticated remote attackers can execute arbitrary OS commands on affected Totolink A7100RU routers through the firewallType parameter, with public exploit details already disclosed.

Affected Products

• Totolink A7100RU router
• Firmware version 7.4cu.2313_b20191024
• /cgi-bin/cstecgi.cgi CGI handler — setFirewallType function

Discovery Timeline

• 2026-04-06 - CVE-2026-5691 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5691

Vulnerability Analysis

The vulnerability exists in the setFirewallType function exposed by the /cgi-bin/cstecgi.cgi endpoint on the Totolink A7100RU router. The handler accepts a firewallType parameter from HTTP requests and passes its value into a system shell invocation without proper sanitization or neutralization of shell metacharacters. An attacker submitting a crafted request can append additional shell commands using characters such as ;, |, &&, or backticks. Because the CGI process typically runs with elevated privileges on embedded devices, successful injection grants the attacker shell-level control of the device. The EPSS probability score of 4.736% (89th percentile) indicates a relatively elevated likelihood of exploitation compared to typical CVEs. Technical details and a proof of concept are documented in the GitHub PoC Repository and VulDB #355518.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The setFirewallType handler concatenates user-controlled input directly into a command string passed to a system call, rather than validating the input against an allowlist or using safe API alternatives that separate arguments from the command interpreter.

Attack Vector

The attack is delivered remotely over the network. An attacker sends an HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setFirewallType topic with a malicious firewallType value containing shell metacharacters. No authentication or user interaction is required. The injected commands execute in the context of the web server process on the router.

No verified exploit code is reproduced here. Refer to the GitHub PoC Repository for technical reproduction details.

Detection Methods for CVE-2026-5691

Indicators of Compromise

• HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setFirewallType topic and shell metacharacters (;, |, &, $(), backticks) in the firewallType parameter.
• Unexpected outbound connections from the router to attacker-controlled infrastructure following CGI requests.
• Unauthorized changes to firewall configuration, DNS settings, or new processes spawned by the cstecgi.cgi binary.

Detection Strategies

• Inspect web server and reverse proxy logs in front of the router management interface for requests targeting setFirewallType with non-alphanumeric values.
• Deploy network intrusion detection signatures that match command injection patterns against cstecgi.cgi request bodies.
• Correlate router administrative requests with the source IP reputation and geolocation to identify anomalous management traffic.

Monitoring Recommendations

• Monitor for any exposure of the router management interface (TCP/80, TCP/443) to untrusted networks or the public internet.
• Alert on configuration drift in firewall rules and DNS resolvers on affected devices.
• Track DNS queries originating from the router for indicators of command-and-control or data exfiltration activity.

How to Mitigate CVE-2026-5691

Immediate Actions Required

• Remove the Totolink A7100RU management interface from any internet-facing or untrusted network exposure.
• Restrict access to /cgi-bin/cstecgi.cgi via firewall rules so that only trusted administrative hosts can reach the device.
• Audit affected devices for signs of compromise, including modified firewall rules, unexpected user accounts, and unknown running processes.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Consult the Totolink Official Website and the VulDB entry for any forthcoming firmware updates addressing CVE-2026-5691. If the device has reached end of support, plan replacement with a supported model.

Workarounds

• Disable remote administration on the WAN interface and restrict management to a dedicated VLAN.
• Place affected routers behind an upstream firewall that filters inbound HTTP/HTTPS requests to the management port.
• Segment IoT and SOHO routing equipment from sensitive internal networks to limit blast radius if the device is compromised.

# Example iptables rule to restrict management interface access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP