CVE-2026-5997 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setLoginPasswordCfg admpass os command injection

A vulnerability described as critical has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os command injection.

This vulnerability is known as CVE-2026-5997. It is possible to launch the attack remotely. Furthermore, an exploit is available.