CVE-2026-5853

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument addrPrefixLen leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Totolink	A7100RU	7.4cu.2313_b20191024

References

Timeline

Published: Apr 9, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-585307.8Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.CVE-2026-585317.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to CVE-2026-585327.8Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-585337.5Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-585347.8Heap-based buffer overflow in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.CVE-2026-585357.5Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-585367.8Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-585377.8Use after free in Microsoft NAT Helper Components (ipnathlp.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-585387.8Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.CVE-2026-585397.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-58549.8A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cg CVE-2026-585407.8Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.