CVE-2026-5688: Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection

Published Apr 6, 2026

Updated

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Affected Software

1 affected component

TOTOLINK A7100RU=7.4cu.2313_b20191024

Event History

Apr 6, 2026

CVE Published

via MITRE·10:15 PM

Data Sourced

via MITRE·10:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:16 PM

DescriptionSeverityWeakness

Nov 16, 58530

Event

via NVD·03:22 AM

Frequently Asked Questions

What is the severity of CVE-2026-5688?

CVE-2026-5688 has a high severity rating due to the potential for OS command injection.

How do I fix CVE-2026-5688?

To fix CVE-2026-5688, update the Totolink A7100RU device firmware to the latest version provided by the manufacturer.

What systems are affected by CVE-2026-5688?

CVE-2026-5688 affects the Totolink A7100RU running firmware version 7.4cu.2313_b20191024.

What type of vulnerability is CVE-2026-5688?

CVE-2026-5688 is classified as an OS command injection vulnerability.

What could an attacker do exploiting CVE-2026-5688?

An attacker exploiting CVE-2026-5688 could execute arbitrary commands on the affected system, potentially leading to full system compromise.