CVE-2026-5996

CVE-2026-5996 is a critical operating system command injection vulnerability in the Totolik A7100RU router (firmware version 7.4cu.2313_b20191024) affecting the setAdvancedInfoShow function within the /cgi-bin/cstecgi.cgi CGI handler component. An attacker can manipulate the tty_server parameter to execute arbitrary OS commands on the affected device. The vulnerability carries a CVSS 3.1 score of 9.8 CRITICAL with a network-based attack vector requiring no authentication, low complexity, and no user interaction. Successful exploitation grants an attacker complete system compromise with high impact to confidentiality, integrity, and availability. While the vulnerability has been publicly disclosed, it is not currently listed on CISA's Known Exploited Vulnerabilities catalog, and there is no evidence of active exploitation in the wild. However, with a public disclosure and CVSS score in the critical range, defensive measures should be prioritized immediately. The relatively low EPSS score suggests community exploitation remains limited at present, though this does not diminish the urgency of mitigation efforts given the severity of potential impact.