CVE-2026-5677: Totolink A7100RU cstecgi.cgi CsteSystem os command injection

Published Apr 6, 2026

Updated

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Affected Software

1 affected component

TOTOLINK A7100RU=7.4cu.2313_b20191024

Event History

Apr 6, 2026

CVE Published

via MITRE·06:30 PM

Data Sourced

via MITRE·06:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Mar 23, 58521

Event

via NVD·06:00 AM

Frequently Asked Questions

What is the severity of CVE-2026-5677?

The severity of CVE-2026-5677 is medium with a score of 6.9.

How do I fix CVE-2026-5677?

Fixing CVE-2026-5677 involves applying the latest firmware update for the Totolink A7100RU device.

What is the risk associated with CVE-2026-5677?

CVE-2026-5677 poses a medium risk, allowing for remote exploitation through OS command injection.

Can CVE-2026-5677 be exploited remotely?

Yes, CVE-2026-5677 can be exploited remotely through the manipulation of the resetFlags argument.

What type of vulnerability is CVE-2026-5677?

CVE-2026-5677 is an OS command injection vulnerability affecting the CsteSystem function in the Totolink A7100RU.