CVE-2026-5677

CVE-2026-5677 is a remote code execution vulnerability in Totolik A7100RU router firmware version 7.4cu.2313_b20191024, specifically affecting the CsteSystem function in the /cgi-bin/cstecgi.cgi endpoint. An attacker can inject arbitrary operating system commands by manipulating the resetFlags parameter without requiring authentication or user interaction. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code on affected routers. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector, low complexity, and no privilege or user interaction requirements. The attack impacts the confidentiality, integrity, and availability of the affected system, making it a significant threat to router security. The EPSS score of 0.048 indicates it poses a higher risk than approximately 89.6 percent of known vulnerabilities. Exploit code has been publicly released and is available for malicious use, though the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog. The CVE remains on an inactive status in threat tracking systems, suggesting limited active exploitation despite public exploit availability. Organizations operating Totolik A7100RU routers should prioritize patching or implementing network-level controls to restrict access to the vulnerable endpoint.