CVE-2026-5850: Command Injection in Totolink A7100RU

The impact of this vulnerability is severe. Successful exploitation allows an attacker to gain complete control over the affected Totolink A7100RU router. This includes the ability to modify router configurations, intercept network traffic, install malware, and potentially pivot to other devices on the network. Given the router's role as a gateway, a compromised device can expose the entire internal network to external threats. The availability of a public exploit significantly increases the likelihood of widespread exploitation, mirroring the rapid spread seen with vulnerabilities like those affecting IoT devices.

1. Reserved2026-04-08
2. Published2026-04-09
3. Modified2026-04-13
4. EPSS updated2026-04-16

The primary mitigation is to upgrade the Totolink A7100RU firmware to a patched version. Unfortunately, a fixed version is not currently specified. As a temporary workaround, consider implementing strict firewall rules to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted sources. Monitor network traffic for suspicious activity, particularly attempts to access this endpoint with unusual parameters. Implement a Web Application Firewall (WAF) with rules to detect and block command injection attempts targeting the pptpPassThru parameter. After applying any mitigation, verify functionality by attempting to access the router's configuration interface and confirming that the pptpPassThru parameter is properly sanitized.