Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os コマンドインジェクション

The impact of CVE-2026-5995 is severe. Successful exploitation allows an attacker to gain complete control over the affected Totolink A7100RU router. This could lead to unauthorized access to the internal network, data exfiltration, malware deployment, and disruption of services. Given the router's role as a gateway, attackers could potentially pivot to other devices on the network, expanding the blast radius significantly. The availability of a public exploit dramatically increases the risk of widespread exploitation, similar to vulnerabilities that have previously targeted embedded devices.

Small and medium-sized businesses (SMBs) and home users who rely on the Totolink A7100RU router for their internet connectivity are at significant risk. Organizations with multiple Totolink A7100RU routers deployed in their networks face a broader attack surface. Users who have not implemented strong network security practices are particularly vulnerable.

• linux / server:

journalctl -u cstecgi -g 'lan_info='

• linux / server:

ps aux | grep cstecgi | grep lan_info

• generic web:

curl -I http://<router_ip>/cgi-bin/cstecgi.cgi?lan_info=<malicious_input>

1. 2026-04-10Disclosure

   disclosure

1. 予約済み2026-04-09
2. 公開日2026-04-10
3. EPSS 更新日2026-04-17

The primary mitigation for CVE-2026-5995 is to upgrade the Totolink A7100RU router to a patched firmware version as soon as it becomes available. Unfortunately, no fixed version is currently specified. As a temporary workaround, consider implementing strict input validation on the 'lan_info' parameter within the /cgi-bin/cstecgi.cgi file, although this is unlikely to be feasible without modifying the router's firmware. Network segmentation can limit the potential impact of a successful attack. Monitor network traffic for suspicious activity, particularly connections to unusual ports or destinations. If a rollback to a previous firmware version is possible, this may reduce the attack surface, but should be considered a temporary measure only.