CVE-2026-5975: Totolink A7100RU RCE Vulnerability

CVE-2026-5975 Overview

A critical OS command injection vulnerability has been identified in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The vulnerability exists within the CGI Handler component, specifically in the setDmzCfg function located at /cgi-bin/cstecgi.cgi. By manipulating the wanIdx argument, an attacker can inject arbitrary operating system commands that execute with elevated privileges on the affected device. This vulnerability can be exploited remotely without authentication, making it particularly dangerous for devices exposed to the internet.

Critical Impact

Remote attackers can achieve complete system compromise through unauthenticated OS command injection, potentially leading to full device takeover, network pivoting, and persistent backdoor installation.

Affected Products

• Totolink A7100RU firmware version 7.4cu.2313_b20191024
• CGI Handler component (/cgi-bin/cstecgi.cgi)
• setDmzCfg function processing the wanIdx parameter

Discovery Timeline

• April 9, 2026 - CVE-2026-5975 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5975

Vulnerability Analysis

This command injection vulnerability (CWE-77) arises from insufficient input validation in the setDmzCfg function within the Totolink A7100RU's CGI handler. The affected function processes the wanIdx parameter without proper sanitization, allowing attackers to inject shell metacharacters and arbitrary commands into system calls.

The vulnerability is particularly severe because it requires no authentication and can be exploited remotely over the network. When a malicious request is sent to the /cgi-bin/cstecgi.cgi endpoint with a crafted wanIdx parameter, the injected commands execute in the context of the web server process, which typically runs with root privileges on embedded Linux-based router firmware.

Root Cause

The root cause of this vulnerability is improper input validation and the unsafe construction of system commands. The setDmzCfg function accepts user-controlled input through the wanIdx parameter and incorporates it directly into shell command execution without proper sanitization or escaping. This allows command separators (such as ;, |, &&, or backticks) to break out of the intended command context and execute arbitrary commands.

Router firmware often uses shell scripts or direct system() calls to configure network parameters, making them susceptible to command injection when user input is not properly validated before being passed to these system functions.

Attack Vector

The attack vector is network-based, requiring only HTTP access to the router's web management interface. An attacker sends a specially crafted HTTP request to the /cgi-bin/cstecgi.cgi endpoint, targeting the setDmzCfg function with a malicious wanIdx parameter value.

The vulnerability can be exploited by injecting command separators followed by arbitrary shell commands into the wanIdx parameter. For example, an attacker could inject commands to download and execute malware, create backdoor accounts, modify firewall rules, or pivot to attack other devices on the internal network. The exploit has been publicly documented, increasing the likelihood of active exploitation.

For technical details on the exploitation mechanism, refer to the GitHub Vulnerability Repository and VulDB #356529.

Detection Methods for CVE-2026-5975

Indicators of Compromise

• Unusual HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the wanIdx parameter (such as ;, |, &&, `, $())
• Unexpected outbound connections from the router to external IP addresses, particularly on non-standard ports
• Presence of unauthorized processes, files, or scheduled tasks on the router filesystem
• Router configuration changes that were not made by authorized administrators
• Unusual network traffic patterns indicating the router is being used for reconnaissance or attacks against internal hosts

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing command injection patterns targeting /cgi-bin/cstecgi.cgi
• Deploy network intrusion detection/prevention systems (IDS/IPS) with signatures for command injection attacks against Totolink devices
• Monitor HTTP logs for suspicious requests to CGI endpoints with malformed or unusual parameter values
• Establish baseline network behavior for router devices and alert on anomalies

Monitoring Recommendations

• Enable comprehensive logging on network perimeter devices to capture all traffic to and from Totolink routers
• Implement continuous monitoring of router management interface access, particularly from untrusted networks
• Set up alerts for any changes to router configurations or firmware that occur outside of scheduled maintenance windows
• Regularly audit router filesystems for unauthorized modifications or presence of unexpected files

How to Mitigate CVE-2026-5975

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only; do not expose /cgi-bin/cstecgi.cgi to the internet
• Implement network segmentation to isolate IoT and networking devices from critical infrastructure
• Deploy a web application firewall or reverse proxy with input validation rules in front of vulnerable devices
• Monitor for and apply any firmware updates released by Totolink for the A7100RU model
• Consider replacing end-of-life or unsupported devices with actively maintained alternatives

Patch Information

At the time of publication, no official patch has been confirmed from Totolink for this vulnerability. Administrators should monitor the Totolink Security Information page for firmware updates addressing CVE-2026-5975. Additional vulnerability details are available through VulDB Submission #791821 and VulDB CTI for #356529.

Workarounds

• Disable remote management features and restrict web interface access to local network connections only
• Place the router behind a firewall that blocks external access to the management interface
• Use access control lists (ACLs) to limit which IP addresses can reach the router's CGI endpoints
• If possible, disable the DMZ configuration functionality entirely if not required for your deployment

# Example firewall rule to restrict access to router management interface
# Apply on upstream firewall/gateway device
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP
# Allow only from trusted management subnet
iptables -I FORWARD -s 192.168.1.0/24 -d <ROUTER_IP> -p tcp --dport 80 -j ACCEPT