CVE-2026-5854

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-585407.8Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-585417.8Access of resource using incompatible type ('type confusion') in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2026-585427.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.CVE-2026-585436.3Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorizedCVE-2026-585447.0Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-585455.5Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.CVE-2026-585466.5Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-585477.8Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally.CVE-2026-585494.0Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confideCVE-2026-58557.5Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and readsCVE-2026-585504.0Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confideCVE-2026-585515.1Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confide