CVE-2026-5690

CVE-2026-5690 is an OS command injection vulnerability in Totolik A7100RU router firmware version 7.4cu.2313_b20191024, specifically within the setRemoteCfg function of the /cgi-bin/cstecgi.cgi endpoint. The flaw allows attackers to manipulate the "enable" argument to execute arbitrary system commands on the affected device. The attack requires no user interaction or authentication, making it accessible to remote unauthenticated threat actors. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector and low complexity, indicating an easily exploitable flaw with minimal barriers to entry. Successful exploitation could result in confidentiality, integrity, and availability impacts, though the FAUCET risk score of 48.0/100 suggests moderate concern within the threat landscape. While the vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hotlists, exploit code has been publicly disclosed, which increases the risk of opportunistic attacks. The relatively low EPSS score indicates this vulnerability has not yet gained significant attention in active threat campaigns, but the availability of working exploits warrants prompt patching of affected Totolik devices.