CVE-2026-5689

HighCVSS 7.3/10Last modified Jul 24, 2026

Description

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setNtpCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument tz results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
TotolinkA7100RU7.4cu.2313_b20191024

References

Timeline

Published
Apr 6, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-568926.2In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local informCVE-2026-56897In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestatCVE-2026-56898In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used CVE-2026-56907.3A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setRemoteCfg of the file /cgi-bin/cstecCVE-2026-56902In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disCVE-2026-569067.0In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege withCVE-2026-569076.7In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with CVE-2026-56909In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missiCVE-2026-56917.3A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setFirewallType of the file /cgi-bin/csteCVE-2026-569108.4In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check.CVE-2026-569116.7In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local CVE-2026-56912In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This could lead to local e
CVE-2026-5689: High severity, CVSS 7.3 | Vulnix