CVE-2026-5854

CVE-2026-5854 is a remote code execution vulnerability affecting Totolik A7100RU wireless router firmware version 7.4cu.2313_b20191024. The flaw exists in the setWiFiEasyCfg function within the CGI Handler component, where improper input validation on the "merge" parameter allows unauthenticated attackers to inject arbitrary operating system commands. The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL with a network-based attack vector requiring no authentication, user interaction, or special privileges. Successful exploitation grants attackers complete control over the affected router, enabling unauthorized data access, system modification, and service disruption. Exploit code is publicly available and may be actively used in the wild. However, the vulnerability currently shows no indication of widespread exploitation according to CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00325 suggests relatively low real-world exploitation probability at this time, though the public availability of proof-of-concept code warrants prioritized remediation for organizations operating Totolik A7100RU devices.