CVE-2026-5692

CVE-2026-5692 is an operating system command injection vulnerability discovered in the Totolik A7100RU router running firmware version 7.4cu.2313_b20191024. The flaw exists in the setGameSpeedCfg function within the /cgi-bin/cstecgi.cgi file, where improper sanitization of the "enable" parameter allows attackers to inject arbitrary commands. This vulnerability affects a network-accessible component with no authentication requirements. The vulnerability carries a CVSS 3.1 severity rating of 7.3 (HIGH), indicating significant risk. The attack vector is network-based with low complexity, requiring no user interaction or privileges, which substantially lowers the barrier to exploitation. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary commands with router-level privileges, potentially compromising network security, device integrity, and availability. Exploit code for this vulnerability has been made publicly available, though it is not currently listed in the CISA Known Exploited Vulnerabilities catalog and shows low exploitation prevalence based on its EPSS score of 0.012. The vulnerability is not actively trending, suggesting limited community attention at present. Organizations operating affected Totolink router models should prioritize firmware updates and implement network segmentation to mitigate this publicly disclosed threat.