CVE-2026-5997: Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection
A vulnerability was detected in Totolink A7100RU 7.4cu.2313b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5997?
The severity of CVE-2026-5997 is high with a score of 8.9.
What type of vulnerability is CVE-2026-5997?
CVE-2026-5997 is an OS command injection vulnerability affecting the function setLoginPasswordCfg.
How do I fix CVE-2026-5997?
To fix CVE-2026-5997, update the Totolink A7100RU firmware to the latest version provided by the vendor.
What components are affected by CVE-2026-5997?
CVE-2026-5997 affects the CGI Handler component, specifically the /cgi-bin/cstecgi.cgi file.
Can CVE-2026-5997 be exploited remotely?
Yes, CVE-2026-5997 can be exploited remotely as the vulnerability allows OS command injection over the network.