CVE-2026-5976

CVE-2026-5976 is an unauthenticated remote code execution vulnerability affecting the Totolik A7100RU router (firmware version 7.4cu.2313_b20191024). The flaw exists in the CGI Handler component, specifically within the setStorageCfg function of /cgi-bin/cstecgi.cgi, where improper input validation on the sambaEnabled parameter allows attackers to inject arbitrary operating system commands. The vulnerability carries a critical CVSS 3.1 score of 9.8 with a network-based attack vector requiring no authentication, user interaction, or special privileges. Successful exploitation grants attackers complete system compromise with high confidentiality, integrity, and availability impact. The attack complexity is low, indicating it can be reliably executed by threat actors. While the vulnerability is not currently tracked as being actively exploited in the wild (KEV inactive status), public exploit code has been released, increasing the risk of opportunistic attacks. The EPSS score of 0.0125 is relatively low, suggesting limited community exploitation to date, though security teams should prioritize patching given the critical severity rating and availability of proof-of-concept code.