CVE-2026-5850 — AI Deep Analysis Summary

🚨 **Essence**: OS Command Injection in TOTOLINK A7100RU. 💥 **Consequences**: Attackers can execute arbitrary system commands, leading to full device compromise, data theft, and network takeover.

🛡️ **Root Cause**: CWE-78 (OS Command Injection). 🐛 **Flaw**: Improper handling of the `pptpPassThru` parameter in the `setVpnPassCfg` function within `/cgi-bin/cstecgi.cgi`.

📦 **Affected Product**: TOTOLINK A7100RU Router. 📅 **Vulnerable Version**: Firmware 7.4cu.2313_b20191024. 🏢 **Vendor**: Totolink (China Jion Electronics).

👑 **Privileges**: Full System Access (Root). 📊 **Impact**: High Confidentiality, Integrity, and Availability loss. Hackers can read sensitive data, modify configs, or crash the device.

⚡ **Threshold**: LOW. 🌐 **Network**: Attack Vector is Network (AV:N). 🔓 **Auth**: No Privileges Required (PR:N). No user interaction needed (UI:N). Easy remote exploitation.

💻 **Public Exploit**: YES. 📂 **Source**: GitHub PoC available (Litengzheng/vuldb_new). 📝 **Tags**: Exploit code is publicly accessible, increasing risk of wild exploitation.

🔍 **Check**: Scan for `/cgi-bin/cstecgi.cgi`. 📡 **Target**: Look for TOTOLINK A7100RU devices. 🧪 **Test**: Attempt to inject commands via `pptpPassThru` parameter in VPN config requests.

🩹 **Official Patch**: Data does not confirm a fixed version yet. 📅 **Published**: 2026-04-09. ⚠️ **Status**: Users should check Totolink.net for updates immediately.

🚧 **Workaround**: Disable remote management. 🛑 **Block**: Restrict access to CGI endpoints via firewall rules. 🔒 **Isolate**: Segment vulnerable devices from critical network assets.

🔥 **Priority**: CRITICAL. 📉 **CVSS**: 9.8 (Critical). 🚀 **Action**: Immediate patching or mitigation required. High risk due to low exploitation barrier and high impact.