CVE-2026-5852

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-585206.1URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cros CVE-2026-585219.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - C CVE-2026-585225.5Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.CVE-2026-585236.5Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-585246.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthoriz CVE-2026-585258.2Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-585267.8Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-585277.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker CVE-2026-585284.6Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical CVE-2026-585297.1Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.CVE-2026-58539.8A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6L CVE-2026-585307.8Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.