---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: Totolink N300RH 6.1c.1353_B20190305
---END_METADATA---

Description Summary:
The Totolink N300RH web management interface contains an OS command injection vulnerability in the setPasswordCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink N300RH web management interface allows remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-9543

Affected Software: Totolink N300RH

Affected Versions: Totolink N300RH 6.1c.1353_B20190305

Vulnerability: The setPasswordCfg function within /cgi-bin/cstecgi.cgi improperly sanitizes the admpass argument, allowing a remote attacker to inject and execute arbitrary OS commands.

Business Impact

This vulnerability provides an attacker with full control over the affected router. With a CVSS score of 9.8, this could lead to the interception of network traffic, redirection of DNS, or the device being utilized as a pivot point for further attacks on the internal network.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version provided by Totolink.

Proactive Monitoring: Monitor the device for unusual configuration changes and audit network traffic originating from the router for signs of compromise.

Compensating Controls: Disable remote access to the Web Management Interface and ensure the device is not accessible from the public internet.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 26, 2026, the exploit has been disclosed publicly. Given the availability of the exploit, the risk of active exploitation is significant.

Analyst Recommendation

Owners of Totolink N300RH devices should update their firmware immediately. If no firmware update is available for a specific version, the device should be taken offline or have its management interface restricted from external access to prevent exploitation.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: CP450
AFFECTED_VERSIONS: 4.1.0
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T09:02:11.392Z
CREDITS: summadeus (VulDB User) (reporter); VulDB Vulnerability Moderation Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/398296","name":"VDB-398296 | TOTOLINK CP450 cstecgi.cgi buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/398296/cti","name":"VDB-398296 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-85031","name":"CVE-2026-85031 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/853096","name":"Submit #853096 | TOTOLINK CP450 V4.1.0 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the TOTOLINK CP450 /cgi-bin/cstecgi.cgi file allows authenticated remote attackers to execute arbitrary code via the topicurl argument.

Executive Summary:
The TOTOLINK CP450 device is susceptible to a critical buffer overflow vulnerability that could allow an authenticated remote attacker to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-85031

Affected Software: TOTOLINK CP450

Affected Versions: 4.1.0

Vulnerability: This is a memory corruption flaw categorized as a buffer overflow (CWE-120) occurring within the cgi-bin/cstecgi.cgi script. An attacker with low-level access can trigger this vulnerability by manipulating the topicurl argument, leading to potential remote code execution.

Business Impact

The criticality of this vulnerability is underscored by its CVSS score of 9.9, which indicates the potential for complete loss of confidentiality, integrity, and availability. Successful exploitation grants an attacker significant control over the network device, which could facilitate lateral movement within the environment, data exfiltration, or total service disruption.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official TOTOLINK support portal for a firmware update that addresses this buffer overflow. If no patch is currently available, restrict network access to the management interface to trusted administrative subnets only.

Proactive Monitoring: Review system logs for unusual activity or unexpected crashes associated with the cstecgi.cgi process. Monitor inbound traffic to the management interface for anomalous patterns in the topicurl parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures designed to detect and block malformed HTTP requests containing excessively long payloads in the topicurl parameter.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or the existence of a public proof-of-concept for this vulnerability. While the vulnerability is not currently confirmed to be under active exploitation, the nature of buffer overflows makes them highly attractive targets for attackers seeking remote code execution.

Analyst Recommendation

Given the critical severity score and the potential for remote code execution, this vulnerability poses a severe risk to network infrastructure. Administrators should prioritize identifying vulnerable CP450 units and restrict their exposure to external networks until an official vendor patch is applied. Immediate isolation of these devices from untrusted network segments is strongly advised to mitigate the threat of unauthorized access.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6681_B20230703
CONFIDENCE: high
MISSING: none
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:01:06.588Z
CREDITS: 577488768 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397117","name":"VDB-397117 | TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397117/cti","name":"VDB-397117 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82616","name":"CVE-2026-82616 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892941","name":"Submit #892941 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setUploadSetting%E6%A0%88%E6%BA%A2%E5%87%BA.pdf","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setUploadSetting function of the TOTOLINK NR1800X allows remote attackers to execute arbitrary code via the FileName argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the TOTOLINK NR1800X router allows remote, authenticated attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-82616

Affected Software: TOTOLINK NR1800X

Affected Versions: 9.1.0u.6681_B20230703

Vulnerability: This vulnerability is a stack-based buffer overflow occurring within the setUploadSetting function of the /cgi-bin/cstecgi.cgi script. An attacker with low-level privileges can trigger this memory corruption by sending a crafted request containing a malicious FileName parameter.

Business Impact

The ability to execute arbitrary code remotely poses a severe risk to organizational infrastructure, as attackers could gain full control over the router, intercept network traffic, or pivot into internal network segments. Given the critical CVSS score of 9.9, this vulnerability represents an immediate threat to the integrity and confidentiality of any network utilizing the affected hardware.

Remediation Plan

Immediate Action: Update the TOTOLINK NR1800X firmware to the latest available version provided by the manufacturer to patch the buffer overflow vulnerability.

Proactive Monitoring: Review web access logs for anomalous traffic directed at /cgi-bin/cstecgi.cgi, particularly requests containing unusually long or malformed FileName arguments.

Compensating Controls: Implement WAF rules to inspect and block requests to the cstecgi.cgi endpoint that exceed expected parameter lengths or contain suspicious character patterns.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept document exists and is attributed to the research write-up referenced by the CVE record.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild; however, a technical proof-of-concept detailing the exploitation mechanism has been publicly disclosed. The vulnerability is highly exploitable due to the lack of sufficient boundary checks on the FileName argument, which allows for reliable control of the execution flow.

Analyst Recommendation

Due to the critical nature of this buffer overflow and the availability of a public proof-of-concept, users must prioritize patching their TOTOLINK NR1800X devices immediately. Organizations that cannot update immediately should restrict administrative access to the affected cstecgi.cgi interface to trusted internal management networks to reduce the attack surface.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6681_B20230703
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:07:32.065Z
CREDITS: 577488768 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397092","name":"VDB-397092 | TOTOLINK NR1800X cstecgi.cgi setUssd command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397092/cti","name":"VDB-397092 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82597","name":"CVE-2026-82597 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/892696","name":"Submit #892696 | TOTOLINK NR1800X V9.1.0u.6681_B20230703 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setuuid%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5.pdf","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the setUssd function of the TOTOLINK NR1800X router, allowing remote attackers to execute arbitrary commands via the ussd parameter.

Executive Summary:
A remote command injection vulnerability in the TOTOLINK NR1800X router exposes the device to unauthorized system-level control by authenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-82597

Affected Software: TOTOLINK NR1800X

Affected Versions: 9.1.0u.6681_B20230703

Vulnerability: The vulnerability is a command injection flaw (CWE-77) located in the setUssd function of the /cgi-bin/cstecgi.cgi file. The application fails to properly sanitize the ussd argument, allowing an attacker with low-level privileges to inject and execute arbitrary system commands.

Business Impact

The ability to inject arbitrary commands into a network device poses a critical risk to organizational security. Successful exploitation could lead to full device compromise, allowing an attacker to intercept network traffic, pivot into internal segments, or establish persistent backdoors. Given the CVSS score of 7.4, this vulnerability represents a high-severity threat that could lead to significant data breaches and operational disruption.

Remediation Plan

Immediate Action: There is no official patch currently available; administrators should immediately restrict access to the management interface of the affected device to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor network traffic for suspicious command execution patterns or unauthorized attempts to access /cgi-bin/cstecgi.cgi in web server logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to detect and block malicious payloads targeting the ussd parameter in HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing attack details and a proof-of-concept is available via the referenced GitHub repository.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation in the wild; however, a published proof-of-concept exists via the researcher's technical write-up, making the exploit risk credible. The flaw is inherently dangerous due to the ease of reaching the vulnerable cgi-bin endpoint.

Analyst Recommendation

Given the availability of a functional proof-of-concept, the risk of exploitation is elevated. Organizations currently using the TOTOLINK NR1800X should prioritize isolating these devices from external networks and strictly limiting management access to authorized internal personnel until the vendor provides a firmware update.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A720R
AFFECTED_VERSIONS: 4.1.5cu.630_B20250509
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-31T09:01:44.777Z
CREDITS: Nicola Giuffrida (finder); Xernary (VulDB User) (reporter); Xernary (VulDB User) (analyst)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/397055","name":"VDB-397055 | TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/397055/cti","name":"VDB-397055 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-82539","name":"CVE-2026-82539 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/888696","name":"Submit #888696 | TOTOLINK A720R V4.1.5cu.630_B20250509 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Xernary/CVE-2026-82539","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TOTOLINK A720R cstecgi.cgi binary allows an authenticated administrator to achieve remote code execution via a crafted MAC filtering request.

Executive Summary:
A critical buffer overflow vulnerability in TOTOLINK A720R firmware allows an authenticated attacker to gain remote code execution, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-82539

Affected Software: TOTOLINK A720R

Affected Versions: 4.1.5cu.630_B20250509

Vulnerability: This is a stack-based memory corruption flaw (CWE-119) triggered by an overly long input in the desc parameter of the setMacFilterRules function. The vulnerability requires an authenticated administrator to trigger, at which point the lack of bounds checking allows for the redirection of process control flow.

Business Impact

Successful exploitation of this vulnerability allows an attacker to hijack the execution flow of the device firmware. This can lead to unauthorized changes to system configurations, the activation of hidden services like Telnet, or complete loss of device integrity. Given the CVSS score of 9.1, this represents a critical risk to network security, potentially allowing an attacker to use the compromised router as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: There is currently no vendor-supplied patch; administrators should restrict administrative access to the web interface to trusted management IPs only and disable unnecessary services.

Proactive Monitoring: Monitor device logs and network traffic for unusual cstecgi.cgi requests or unexpected activation of Telnet services.

Compensating Controls: Implement strict firewall rules to prevent unauthorized access to the web management interface, ensuring that only authenticated administrative traffic is permitted.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced by the researcher.

Analyst Notes: As of August 30, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly reliable for an attacker due to the absence of stack canaries and Position Independent Executable (PIE) protections in the affected binary.

Analyst Recommendation

The severity of this flaw and the availability of a public proof-of-concept necessitate immediate defensive action. Organizations utilizing the TOTOLINK A720R must prioritize isolating these devices from untrusted network segments until the vendor provides a firmware update that addresses the memory corruption issue.

---METADATA---
VENDOR: Totolink
PRODUCT: X5000R
AFFECTED_VERSIONS: V9.1.0u.6369_B20230113
CONFIDENCE: high
MISSING: patch
CREDITS: kiciot (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/361926","name":"VDB-361926 | Totolink X5000R formDdns sub_458E40 buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/361926/cti","name":"VDB-361926 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/808863","name":"Submit #808863 | Totolink X5000R V9.1.0u.6369_B20230113 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Kiciot/cve/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:25:12.755Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in Totolink X5000R allows attackers to execute arbitrary code via the submit-url parameter.

Executive Summary:
A critical buffer overflow vulnerability in the Totolink X5000R router allows remote attackers to achieve arbitrary code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-8137

Affected Software: Totolink X5000R

Affected Versions: V9.1.0u.6369_B20230113

Vulnerability: This vulnerability is a memory corruption flaw caused by a stack-based buffer overflow in the sub_458E40 function of the /boafrm/formDdns endpoint, triggered by an unauthenticated attacker supplying an oversized submit-url parameter.

Business Impact

A successful exploit of this flaw allows attackers to completely compromise the affected router, resulting in full loss of device control, persistent internal network access, and potential interception of network traffic. Given the CVSS score of 8.8, this vulnerability poses a severe risk to organizational perimeter security and operational continuity by enabling malicious actors to establish a pivot point into the local network.

Remediation Plan

Immediate Action: Isolate the affected router from the network or disable external management access until a vendor-supplied firmware update addressing the vulnerability is applied.

Proactive Monitoring: Monitor network traffic for anomalous administrative requests targeting the /boafrm/formDdns endpoint and check device logs for unexpected reboots indicative of service crashes.

Compensating Controls: Implement firewall rules to restrict access to the router management interface exclusively to trusted internal administrative subnets.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exploit is available via GitHub issue reports and referenced write-ups.

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of bounds checking in the legacy binary makes this flaw trivial to trigger remotely.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency due to the availability of public exploit code and the potential for complete device takeover. Apply vendor patches as soon as they become available, and enforce strict network segmentation to limit exposure of router management services.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: N600R
AFFECTED_VERSIONS: 4.3.0cu.7647_B20210106
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the TOTOLINK N600R router, allowing unauthenticated attackers to execute arbitrary commands via the device interface.

Executive Summary:
A critical command injection vulnerability in TOTOLINK N600R routers allows unauthenticated attackers to gain unauthorized control over the device.

Vulnerability Details

CVE-ID: CVE-2026-79912

Affected Software: TOTOLINK N600R

Affected Versions: 4.3.0cu.7647_B20210106

Vulnerability: This is a command injection vulnerability (CWE-77) that occurs due to insufficient input validation. The vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

With a CVSS score of 8.3, this vulnerability poses a severe risk to network infrastructure. Exploitation allows an attacker to execute arbitrary commands, potentially resulting in full device takeover, interception of network traffic, and lateral movement within the local network.

Remediation Plan

Immediate Action: Check the official TOTOLINK support portal for firmware updates addressing this command injection vulnerability. If no patch is available, isolate the device from the public internet.

Proactive Monitoring: Inspect network traffic for anomalous outbound connections or unauthorized administrative commands originating from the router.

Compensating Controls: Disable remote management interfaces and restrict access to the device management panel to internal, trusted network segments via firewall rules.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via a GitHub repository.

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation in the wild. However, the presence of public proof-of-concept material increases the risk of exploitation by malicious actors.

Analyst Recommendation

Due to the nature of command injection and the availability of public proof-of-concept code, this vulnerability is highly dangerous. If an official firmware patch is not yet available, organizations must immediately restrict access to the device to mitigate the risk of unauthorized command execution.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: N600R
AFFECTED_VERSIONS: 4.3.0cu.7647_B20210106
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The TOTOLINK N600R router contains a stack-based buffer overflow in the setSystemConfig function, allowing remote attackers to execute arbitrary code via a crafted Hostname parameter.

Executive Summary:
A critical stack-based buffer overflow in the TOTOLINK N600R router allows remote attackers to compromise the device via malicious input.

Vulnerability Details

CVE-ID: CVE-2026-79911

Affected Software: TOTOLINK N600R

Affected Versions: 4.3.0cu.7647_B20210106

Vulnerability: The setSystemConfig function in the CGI handler improperly validates the Hostname argument, leading to a stack-based buffer overflow. This vulnerability is reachable remotely without authentication.

Business Impact

A successful exploit results in total compromise of the network device, potentially allowing an attacker to intercept traffic, modify configurations, or pivot into the internal network. Given the CVSS score of 10.0, this represents the highest level of risk to organizational infrastructure.

Remediation Plan

Immediate Action: Check the official TOTOLINK support portal for firmware updates and apply them immediately if available.

Proactive Monitoring: Monitor network traffic for anomalous behavior or unauthorized configuration changes originating from the management interface.

Compensating Controls: Restrict access to the router management interface to trusted administrative IP addresses only, and disable remote management features where possible.

Exploitation Status

Public Exploit Available: Yes, a technical analysis and proof-of-concept documentation exist via GitHub.

Analyst Notes: As of August 25, 2026, there is no confirmed active exploitation in the wild; however, public documentation detailing the overflow mechanism exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability and the availability of public exploit information, immediate action is required. If no firmware patch is available, isolate the device from the public internet immediately to prevent exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU allows unauthenticated attackers to execute arbitrary commands via the setAppFilterCfg function.

Executive Summary:
A critical remote OS command injection vulnerability in Totolink A8000RU allows unauthenticated attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-7823

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The function setAppFilterCfg in /cgi-bin/cstecgi.cgi fails to sanitize the enable argument, leading to OS command injection. This allows an unauthenticated, remote attacker to execute arbitrary commands with system-level privileges.

Business Impact

A CVSS score of 9.8 highlights the extreme risk posed by this vulnerability. Total device compromise can lead to complete loss of network visibility, interception of sensitive data, and the use of the router as a foothold for further attacks against the internal network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to patch the command injection flaw.

Proactive Monitoring: Monitor for unusual system processes or unexpected network traffic emanating from the router, which may indicate persistent command execution.

Compensating Controls: Restrict access to the router's web interface to trusted internal IP addresses only, preventing external exposure of the vulnerable CGI script.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 5, 2026, public exploits for this vulnerability are available, significantly increasing the risk of active exploitation.

Analyst Recommendation

The combination of RCE capability and public exploit availability makes this a high-priority threat. Administrators must act immediately to patch the affected devices or restrict network access to the management interface to neutralize the risk of exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: Totolink N300RH: 3.2.4-B20220812
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360925","name":"VDB-360925 | Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360925/cti","name":"VDB-360925 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807204","name":"Submit #807204 | Totolink N300RH N300RH V3_Firmware V3.2.4-B20220812 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-N300RH-setMacFilterRules-34553a41781f809cb952cdcb71ce90d8","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:48:30.658Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Totolink N300RH router allows remote attackers to execute arbitrary code via a malicious MAC address parameter.

Executive Summary:
A critical buffer overflow vulnerability in Totolink N300RH version 3.2.4-B20220812 allows remote attackers to compromise device integrity and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-7750

Affected Software: Totolink N300RH

Affected Versions: Totolink N300RH: 3.2.4-B20220812

Vulnerability: This vulnerability is a buffer overflow (CWE-120) located in the setMacFilterRules function within the /cgi-bin/cstecgi.cgi component, triggered via manipulated mac_address arguments requiring low-privilege authentication over the network.

Business Impact

A successful exploit of this buffer overflow could allow attackers to gain complete control over affected routers, leading to network disruption, interception of internal traffic, and potential pivoting into private local area networks. Based on the CVSS score of 8.8, the severity is high, reflecting the potential for total loss of confidentiality, integrity, and availability of the affected device.

Remediation Plan

Immediate Action: Apply official vendor security firmware updates as soon as they are made available by Totolink.

Proactive Monitoring: Monitor network traffic for anomalous administrative login patterns and unusual POST requests directed at the /cgi-bin/cstecgi.cgi endpoint.

Compensating Controls: Restrict management interface access to trusted internal IP addresses and disable remote management entirely where feasible.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via researcher documentation referenced in the advisory data.

Analyst Notes: As of May 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of published exploit details significantly increases the likelihood of opportunistic attacks against exposed devices.

Analyst Recommendation

Administrators managing affected Totolink N300RH devices must treat this vulnerability with high priority due to the availability of public exploit references and the severity of potential device compromise. Implement immediate compensating controls by isolating management interfaces from the public internet while awaiting official vendor patches.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: Totolink N300RH: 3.2.4-B20220812
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360924","name":"VDB-360924 | Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360924/cti","name":"VDB-360924 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807203","name":"Submit #807203 | Totolink N300RH N300RH V3_Firmware V3.2.4-B20220812 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-N300RH-setWanConfig-34553a41781f80ed8500d9b8d54074f2","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:48:38.122Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in Totolink N300RH allows remote authenticated attackers to execute arbitrary code via the priDns parameter.

Executive Summary:
A buffer overflow vulnerability affects Totolink N300RH version 3.2.4-B20220812, creating a high-severity risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-7749

Affected Software: Totolink N300RH

Affected Versions: Totolink N300RH: 3.2.4-B20220812

Vulnerability: This flaw involves a buffer overflow (CWE-120) located in the setWanConfig function within the /cgi-bin/cstecgi.cgi file of the POST Request Handler component, requiring low privileges for an attacker to trigger remotely.

Business Impact

A successful exploit of this vulnerability could lead to total compromise of the affected router, allowing attackers to manipulate network traffic, intercept sensitive data, or disrupt business operations. The CVSS score of 8.8 reflects the high risk of complete system compromise via remote network exploitation.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available or restrict administrative access to trusted internal networks only.

Proactive Monitoring: Monitor network devices for anomalous traffic patterns, unexpected reboots, or unauthorized configuration changes.

Compensating Controls: Implement strict network segmentation and firewall rules to limit exposure of the router management interface to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced researcher write-up.

Analyst Notes: As of May 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published technical write-up indicates that attack mechanics are publicly understood.

Analyst Recommendation

Given the high CVSS score and the availability of a public proof-of-concept, administrators should treat this vulnerability with urgency. Mitigate exposure immediately by restricting remote access interfaces and applying patches as soon as the vendor provides them.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: Totolink N300RH: 3.2.4-B20220812
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360923","name":"VDB-360923 | Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360923/cti","name":"VDB-360923 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807202","name":"Submit #807202 | Totolink N300RH N300RH V3_Firmware V3.2.4-B20220812 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-N300RH-setUpgradeFW-34553a41781f80abb1d1c627d7ff4329?pvs=73","name":null,"tags":["exploit","patch"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:48:45.678Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in Totolink N300RH version 3.2.4-B20220812 allows remote authenticated attackers to execute arbitrary code via the FileName argument in the setUpgradeFW function.

Executive Summary:
A critical buffer overflow vulnerability in the Totolink N300RH router allows remote attackers to achieve full system compromise through the firmware upgrade handler.

Vulnerability Details

CVE-ID: CVE-2026-7748

Affected Software: Totolink N300RH

Affected Versions: Totolink N300RH: 3.2.4-B20220812

Vulnerability: This flaw is a buffer overflow (CWE-120) located within the setUpgradeFW function of the /cgi-bin/cstecgi.cgi component, triggered by manipulating the FileName argument. The attack can be launched remotely by a low-privileged authenticated user with no user interaction required.

Business Impact

A successful exploit of this vulnerability can lead to total loss of confidentiality, integrity, and availability on the affected device, potentially allowing an adversary to take complete control of the router. Given the CVSS score of 8.8, this high severity rating reflects the severe impact on device stability and network security, potentially compromising the entire local network segment behind the device.

Remediation Plan

Immediate Action: Apply vendor firmware updates as soon as they become available from Totolink, or restrict administrative interface access to trusted internal management networks only.

Proactive Monitoring: Monitor network traffic and device logs for anomalous administrative login sessions and unexpected restarts of the Totolink N300RH device.

Compensating Controls: Implement strict network segmentation and firewall rules to prevent unauthorized or untrusted remote access to the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept reference exists from the vulnerability disclosure.

Analyst Notes: As of May 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a researcher-provided write-up confirms that functional exploit details are publicly accessible.

Analyst Recommendation

Security teams managing Totolink N300RH routers must treat this vulnerability with high urgency due to the potential for complete device compromise. Administrators should immediately check for firmware patches, restrict management access, and monitor device logs closely until an official fix is applied.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: 3.2.4-B20220812
---END_METADATA---

Description Summary:
A remote buffer overflow vulnerability in the Totolink N300RH login authentication function allows attackers to crash the system or execute arbitrary code.

Executive Summary:
A critical remote buffer overflow vulnerability in Totolink N300RH allows unauthenticated attackers to execute arbitrary code via the password field.

Vulnerability Details

CVE-ID: CVE-2026-7747

Affected Software: Totolink N300RH

Affected Versions: 3.2.4-B20220812

Vulnerability: The loginauth function within /cgi-bin/cstecgi.cgi contains a buffer overflow vulnerability triggered by an overly long input in the Password argument. This allows for remote, unauthenticated exploitation.

Business Impact

A CVSS score of 9.8 reflects the high risk of remote code execution (RCE) on network infrastructure. Successful exploitation could lead to full device compromise, allowing attackers to intercept network traffic, pivot into internal networks, or render the device unusable, causing significant operational downtime.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update immediately. If no update is available, restrict management interface access to trusted IP ranges.

Proactive Monitoring: Monitor device logs for unexpected reboots or service crashes, which may indicate failed or successful overflow attempts.

Compensating Controls: Disable remote management interfaces on the device and ensure it is not exposed directly to the internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 4, 2026, public exploits for this vulnerability are available, significantly increasing the likelihood of active exploitation. Immediate mitigation is required.

Analyst Recommendation

Due to the availability of public exploits and the critical nature of the RCE, this vulnerability represents an urgent security risk. Organizations using the Totolink N300RH must isolate the device or apply the latest firmware to prevent unauthorized access and potential system takeover.

---METADATA---
VENDOR: Totolink
PRODUCT: WA300
AFFECTED_VERSIONS: 5.2cu.7112_B20190227
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the Totolink WA300 loginauth function allows remote attackers to execute arbitrary code via a manipulated http_host argument.

Executive Summary:
A critical buffer overflow vulnerability in Totolink WA300 devices allows remote, unauthenticated attackers to trigger arbitrary code execution via the web interface.

Vulnerability Details

CVE-ID: CVE-2026-7719

Affected Software: Totolink WA300

Affected Versions: 5.2cu.7112_B20190227

Vulnerability: The vulnerability exists in the loginauth function within the /cgi-bin/cstecgi.cgi component. An attacker can supply an overly long http_host argument to trigger a buffer overflow, which may result in remote code execution.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe risk to organizational security. Successful exploitation allows an attacker to gain remote access to the device, potentially leading to unauthorized network access, interception of traffic, or complete disruption of network services.

Remediation Plan

Immediate Action: Update the affected Totolink WA300 firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for suspicious POST requests targeting cstecgi.cgi and review device logs for crash events or unusual authentication attempts.

Compensating Controls: Restrict access to the device's web management interface to trusted administrative IP addresses only and deploy a WAF to block malformed HTTP requests.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of May 4, 2026, this vulnerability is known to have public exploit code available, significantly increasing the risk of active exploitation. Immediate patching is mandatory.

Analyst Recommendation

Due to the availability of public exploits, this vulnerability is highly dangerous. Security teams must isolate affected devices from the public internet immediately and apply the necessary firmware updates to remediate the buffer overflow risk.

---METADATA---
VENDOR: Totolink
PRODUCT: WA300
AFFECTED_VERSIONS: Totolink WA300: 5.2cu.7112_B20190227
CONFIDENCE: high
MISSING: patch
CREDITS: wxhwxhwxh_mie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360893","name":"VDB-360893 | Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360893/cti","name":"VDB-360893 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/807193","name":"Submit #807193 | Totolink WA300 WA300 V5.2cu.7112_B20190227 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://lavender-bicycle-a5a.notion.site/TOTOLINK-WA300-UploadCustomModule-34553a41781f80a8a287e48a7fb04de9","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:49:00.938Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in Totolink WA300 allows remote authenticated attackers to execute arbitrary code via the File argument in the UploadCustomModule function.

Executive Summary:
A buffer overflow vulnerability in the Totolink WA300 router allows remote attackers to achieve total system compromise by manipulating the File argument within the UploadCustomModule function.

Vulnerability Details

CVE-ID: CVE-2026-7717

Affected Software: Totolink WA300

Affected Versions: Totolink WA300: 5.2cu.7112_B20190227

Vulnerability: This flaw is classified as a buffer overflow (CWE-120) and memory corruption issue residing in the UploadCustomModule function of the /cgi-bin/cstecgi.cgi component, requiring low privileges (authenticated user) and network access to trigger.

Business Impact

A successful exploit of this vulnerability can result in total system compromise, including loss of confidentiality, integrity, and availability of the affected networking device. Given the CVSS score of 8.8, an attacker could potentially intercept network traffic, pivot to internal network segments, or render the device inoperable, posing a severe risk to organizational operations and network security.

Remediation Plan

Immediate Action: Apply official firmware updates from Totolink as soon as they become available, or restrict management interface access to trusted internal networks only.

Proactive Monitoring: Monitor device access logs and network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi involving the UploadCustomModule function.

Compensating Controls: Implement strict network segmentation and place vulnerable devices behind a firewall or VPN to prevent unauthorized remote access to the management interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the vendor vulnerability advisory and security research write-up.

Analyst Notes: As of May 5, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a technical write-up detailing the request parameters elevates the urgency for defensive measures.

Analyst Recommendation

This vulnerability presents a high risk due to the potential for remote code execution and total system compromise on affected networking hardware. Administrators must prioritize restricting administrative access to trusted management networks and apply vendor patches immediately upon release to secure the environment against potential exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6279_B20210910
CONFIDENCE: high
MISSING: patch
CREDITS: NEWYM (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/360358","name":"VDB-360358 | Totolink NR1800X cstecgi.cgi sub_41A68C command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/360358/cti","name":"VDB-360358 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/804417","name":"Submit #804417 | Totolink C834FR-1C NR1800X command injection","tags":["third-party-advisory"]},{"url":"https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.631Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the Totolink NR1800X router allows authenticated attackers to execute arbitrary system commands via the setUssd function in cstecgi.cgi.

Executive Summary:
A critical command injection vulnerability in the Totolink NR1800X router allows authenticated attackers to gain unauthorized remote code execution on the affected device.

Vulnerability Details

CVE-ID: CVE-2026-7548

Affected Software: Totolink NR1800X

Affected Versions: 9.1.0u.6279_B20210910

Vulnerability: The vulnerability exists within the sub_41A68C function of the cstecgi.cgi script, where the ussd parameter is improperly sanitized before being concatenated into a command string passed to the system shell. An attacker with valid user credentials can trigger this flaw by sending a crafted JSON request to the setUssd endpoint.

Business Impact

Successful exploitation of this vulnerability results in full remote code execution on the network gateway. This allows an attacker to intercept traffic, pivot into internal network segments, or permanently disable the device, leading to significant service disruption and potential compromise of sensitive internal data. With a CVSS score of 8.8, this flaw represents a high risk to organizational security posture.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware release, as no public patch is currently confirmed. Until a fix is applied, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at cstecgi.cgi that contain suspicious characters or shell command syntax within the ussd parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or local firewall rules to block access to the management interface for all unauthorized users.

Exploitation Status

Public Exploit Available: Yes — a functional proof of concept is available via the researcher's GitHub repository.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the CGI handler.

Analyst Recommendation

Given the availability of a public proof of concept and the high potential for full system compromise, administrators must treat this as a high-priority issue. If firmware updates are not immediately available, ensure the router management interface is not exposed to the public internet and enforce strict authentication controls to minimize the attack surface.

---METADATA---
VENDOR: Totolink
PRODUCT: NR1800X
AFFECTED_VERSIONS: 9.1.0u.6279_B20210910
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in the Totolink NR1800X lighttpd component, allowing remote attackers to trigger a crash or execute code via the Host header.

Executive Summary:
A critical stack-based buffer overflow in the Totolink NR1800X router allows remote, unauthenticated attackers to compromise device integrity.

Vulnerability Details

CVE-ID: CVE-2026-7546

Affected Software: Totolink NR1800X

Affected Versions: 9.1.0u.6279_B20210910

Vulnerability: The vulnerability exists in the find_host_ip function of the lighttpd component. By sending a crafted Host header, an unauthenticated remote attacker can trigger a buffer overflow.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. Successful exploitation allows remote code execution, which could lead to unauthorized access to the local network, interception of traffic, or the use of the device as a pivot point for further lateral movement within the business environment.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to address the buffer overflow in the web server component.

Proactive Monitoring: Monitor device traffic for anomalous HTTP headers and inspect system logs for service crashes or unexpected restarts of the lighttpd process.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering to block requests containing abnormally large or malformed Host headers.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 1, 2026, there is public disclosure of an exploit for this vulnerability. Given the ease of remote exploitation, immediate patching is mandatory to prevent unauthorized device control.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public exploits, poses an imminent risk to network security. Organizations utilizing the affected Totolink hardware must prioritize firmware updates or restrict management interface access to trusted internal segments immediately.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
The Totolink A8000RU router is vulnerable to remote OS command injection via the proto parameter in the CGI handler, allowing unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU allows unauthenticated remote attackers to achieve full system-level code execution.

Vulnerability Details

CVE-ID: CVE-2026-7538

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw resides in the /cgi-bin/cstecgi.cgi script, specifically within the proto argument. An unauthenticated attacker can inject shell commands that are executed with the privileges of the web server.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a severe threat to business infrastructure. An attacker gaining command execution on a gateway device can bypass perimeter security, sniff internal traffic, or exfiltrate sensitive data, leading to significant operational disruption and data breach risks.

Remediation Plan

Immediate Action: Update the affected Totolink A8000RU device to the latest firmware version provided by the manufacturer.

Proactive Monitoring: Review web server access logs for suspicious patterns in CGI requests, particularly those containing shell metacharacters (e.g., ;, |, &).

Compensating Controls: Disable access to the web-based management interface from untrusted or external networks until the firmware can be patched.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of May 1, 2026, public exploit code for this vulnerability is available. The ability to execute arbitrary commands remotely makes this a high-priority target for threat actors.

Analyst Recommendation

Due to the critical nature of remote code execution on network infrastructure, immediate remediation is required. Affected devices should be isolated from the public internet until the patch is applied.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler is reachable via the setWiFiEasyGuestCfg function's merge argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7244

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The setWiFiEasyGuestCfg function within /cgi-bin/cstecgi.cgi is vulnerable to OS command injection. An unauthenticated remote attacker can inject commands by manipulating the merge argument.

Business Impact

The CVSS score of 9.8 identifies this as a critical issue. Successful exploitation allows an attacker to gain full control over the router, compromising the security of both the primary and guest wireless networks.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to remediate the vulnerability.

Proactive Monitoring: Monitor for unauthorized changes to guest Wi-Fi configurations and unusual system activity.

Compensating Controls: Restrict administrative access to the router to trusted internal management subnets.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, public exploits are available for this vulnerability. Immediate action is required to protect the network.

Analyst Recommendation

This vulnerability is highly severe and requires immediate patching. Administrators should verify the current firmware version and ensure it is updated to the latest release to prevent exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
The Totolink A8000RU is susceptible to remote OS command injection in the setRadvdCfg function, reachable via the maxRtrAdvInterval argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7243

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability is located in the setRadvdCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can leverage the maxRtrAdvInterval argument to perform OS command injection.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a significant risk to the security of the network. Successful exploitation allows for complete device control, potentially leading to widespread network compromise and data theft.

Remediation Plan

Immediate Action: Update the affected Totolink A8000RU unit to the latest firmware version.

Proactive Monitoring: Monitor for suspicious network traffic and verify the integrity of router configuration settings.

Compensating Controls: Block access to the CGI handler from untrusted sources using firewall or access control lists.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, this vulnerability is publicly documented with available exploit code. It should be treated as an urgent patching priority.

Analyst Recommendation

Administrators must prioritize the firmware update to mitigate this high-risk vulnerability. Given the ease of exploitation, ensure that the device management interface is not exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler is accessible via the setOpenVpnClientCfg function's enabled argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7242

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The setOpenVpnClientCfg function in the /cgi-bin/cstecgi.cgi file contains an OS command injection vulnerability. An unauthenticated attacker can exploit this by sending a crafted request to the enabled argument.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability. Exploitation can lead to complete takeover of the router, allowing attackers to compromise VPN connections and gain unauthorized access to the internal network.

Remediation Plan

Immediate Action: Update the router to the latest available firmware version to patch this security flaw.

Proactive Monitoring: Monitor for unexpected VPN configuration changes and anomalous outbound traffic from the device.

Compensating Controls: Restrict access to the router's web interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, public exploit code exists, making this a high-priority threat for any organization using the affected equipment.

Analyst Recommendation

Immediate patching is required to address this vulnerability. Organizations should also conduct a review of their VPN configuration to ensure that no unauthorized changes have been made.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
The Totolink A8000RU is vulnerable to remote OS command injection via the setWiFiBasicCfg function, triggered by the wifiOff argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7241

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability is found in the setWiFiBasicCfg function of the /cgi-bin/cstecgi.cgi component. Unauthenticated attackers can inject OS commands by manipulating the wifiOff argument.

Business Impact

The CVSS score of 9.8 indicates a critical security risk. An attacker can execute arbitrary commands with high privileges, leading to full device compromise and potential disruption of wireless network services.

Remediation Plan

Immediate Action: Apply the latest firmware update released by the vendor to resolve this vulnerability.

Proactive Monitoring: Inspect system logs for unusual behavior and monitor for unauthorized changes to Wi-Fi settings.

Compensating Controls: If a patch is unavailable, block all external access to the device management interface using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, the vulnerability is publicly known and exploitable. The potential for widespread impact is high.

Analyst Recommendation

Patching is the only reliable way to fix this vulnerability. Administrators should ensure that all Totolink devices are updated to the latest version and verify that remote management is disabled to reduce the attack surface.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler is reachable through the setVpnAccountCfg function's User argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to achieve full system control.

Vulnerability Details

CVE-ID: CVE-2026-7240

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The setVpnAccountCfg function in the /cgi-bin/cstecgi.cgi file fails to sanitize the User argument. This oversight enables an unauthenticated attacker to inject arbitrary OS commands remotely.

Business Impact

With a CVSS score of 9.8, this is a high-impact vulnerability. Successful exploitation grants the attacker administrative access to the router, which can be used to compromise the entire network, intercept traffic, or facilitate lateral movement.

Remediation Plan

Immediate Action: Update the affected device to the most recent firmware version provided by the manufacturer.

Proactive Monitoring: Monitor logs for suspicious input characters in web requests and watch for unauthorized VPN account modifications.

Compensating Controls: Disable remote management of the router and limit access to the internal network side only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, the vulnerability is public and exploitable. Immediate remediation is necessary to mitigate the risk of remote takeover.

Analyst Recommendation

Organizations should prioritize updating the vulnerable firmware. Given that this is a command injection vulnerability, it is essential to assume that any exposed device may have been compromised and to perform a security audit of the network environment post-patching.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
The Totolink A8000RU is susceptible to remote OS command injection via the setPptpServerCfg function and the enable argument in the CGI handler.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7204

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setPptpServerCfg function of the /cgi-bin/cstecgi.cgi component. Lack of proper input sanitization on the enable argument allows remote, unauthenticated attackers to inject and execute OS commands.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this flaw, which allows for full device takeover. Unauthorized remote access can result in data exfiltration, internal network reconnaissance, and the deployment of persistent malware on the router.

Remediation Plan

Immediate Action: Update the router firmware to the latest version supplied by Totolink to remediate the vulnerability.

Proactive Monitoring: Monitor for anomalous traffic and unauthorized configuration changes, particularly those related to VPN or server settings.

Compensating Controls: Use a firewall to block external access to the device's CGI management interface if an immediate firmware update is not possible.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, the vulnerability is known to the public with exploit code available, posing an immediate risk to any exposed Totolink A8000RU units.

Analyst Recommendation

Given the availability of exploits, immediate patching is required. Administrators should verify the integrity of their network configurations after applying updates to ensure no unauthorized persistence mechanisms were installed during the period of exposure.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler, reachable via the setUrlFilterRules function and the enable argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7203

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setUrlFilterRules function within the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can trigger remote OS command injection by passing malicious input to the enable parameter.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a severe threat to network infrastructure. Exploitation grants an attacker the ability to bypass security filters, modify device configurations, and execute arbitrary code, potentially leading to a complete breach of the network segment managed by the device.

Remediation Plan

Immediate Action: Update the firmware to the latest version provided by the manufacturer to resolve the command injection flaw.

Proactive Monitoring: Review system logs for unexpected execution of shell commands and monitor for unauthorized changes to URL filtering rules.

Compensating Controls: Implement strict network segmentation and ensure the router's management interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, public exploitation material is available. The ease of remote access makes this a high-priority target for threat actors.

Analyst Recommendation

This flaw requires immediate attention due to the high risk of remote takeover. Administrators should apply the vendor-supplied patch as the primary mitigation and ensure that access to the device management interface is restricted to authorized users only.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler allows attackers to execute arbitrary code via the wscDisabled argument.

Executive Summary:
A critical remote command injection vulnerability in the Totolink A8000RU router allows unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7202

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection vulnerability within the setWiFiWpsStart function of the /cgi-bin/cstecgi.cgi handler. The vulnerability permits an unauthenticated remote attacker to inject malicious system commands by manipulating the wscDisabled argument.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows for complete unauthorized control over the networking device. Successful exploitation could lead to total loss of device integrity, interception of network traffic, and a pivot point for further lateral movement within the corporate or home network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink immediately to patch the affected CGI handler.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous command execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to block malicious requests targeting the /cgi-bin/cstecgi.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 28, 2026, public exploit code for this vulnerability is available and active exploitation is possible. Immediate patching is mandatory to prevent compromise.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public exploits, organizations must prioritize patching the affected Totolink hardware. If an update is not immediately feasible, restrict management interface access to trusted administrative networks only.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Totolink A8000RU CGI handler contains an OS command injection vulnerability in the CsteSystem function reachable via remote HTTP requests.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU allows remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-7156

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability exists within the CsteSystem function of the /cgi-bin/cstecgi.cgi component. An attacker can manipulate the HTTP argument to inject and execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to network integrity. An attacker can gain full remote control of the device, which may be used as a pivot point for further lateral movement within the internal network, resulting in total data exposure and persistent unauthorized access.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet and check the vendor website for the latest firmware update to patch the CGI handler.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at /cgi-bin/cstecgi.cgi and inspect device logs for evidence of command execution.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses only, and utilize a WAF to inspect and block malicious payload patterns in CGI parameters.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 27, 2026, public exploits are available for this vulnerability. Given the ease of remote exploitation, the risk of active targeting is extremely high.

Analyst Recommendation

Given the availability of public exploits and the critical nature of command injection, this device must be secured immediately. If a patch is unavailable, the device should be isolated from external networks to prevent exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the admpass argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7155

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi, where improper validation of the admpass parameter allows for unauthenticated remote OS command injection.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this flaw. Exploitation allows an attacker to gain administrative control over the router, which can be used to intercept traffic, modify device settings, or deploy malware, leading to severe business and operational impacts.

Remediation Plan

Immediate Action: Update the Totolink A8000RU device to the latest firmware version released by the manufacturer.

Proactive Monitoring: Monitor for unusual login or password change attempts and inspect logs for abnormal command strings directed at the CGI interface.

Compensating Controls: Restrict administrative access to the router to trusted internal subnets and ensure the management interface is not accessible from the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available for this vulnerability. The lack of required authentication and the potential for full system compromise warrant immediate action.

Analyst Recommendation

To ensure the security of the network, administrators must apply the latest firmware update for the Totolink A8000RU without delay. Proactive patching is the most effective way to address this critical vulnerability and prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7154

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw exists in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi, where the tty_server parameter is not properly sanitized, allowing an unauthenticated remote attacker to inject and execute OS commands.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk of complete device takeover. Successful exploitation can result in unauthorized access to sensitive internal network segments, potentially leading to catastrophic security breaches and loss of system availability.

Remediation Plan

Immediate Action: Patch the Totolink A8000RU device immediately by installing the latest vendor-provided firmware update.

Proactive Monitoring: Regularly audit device logs for unexpected process execution or suspicious input parameters sent to the CGI interface.

Compensating Controls: Isolate the management interface from the public internet using firewalls or VPN-only access to mitigate the risk from remote attackers.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available. The ability to execute remote commands without authentication makes this a high-priority target for threat actors.

Analyst Recommendation

Immediate remediation is essential to mitigate the risk of remote compromise. Organizations should apply the latest firmware update provided by Totolink as soon as possible to protect against this known, exploitable vulnerability.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary system commands via the sys_info argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7153

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability affects the setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi, where insufficient filtering of the sys_info argument permits unauthenticated remote OS command injection.

Business Impact

The CVSS score of 9.8 reflects the high severity of this remote code execution flaw. If exploited, an attacker could gain persistent access to the network, potentially leading to data exfiltration and severe compromise of the internal network integrity.

Remediation Plan

Immediate Action: Update the Totolink A8000RU device to the latest available firmware release.

Proactive Monitoring: Monitor for anomalous traffic patterns directed at the CGI interface and watch for unauthorized command execution attempts in system logs.

Compensating Controls: Use a Web Application Firewall (WAF) or equivalent network security policy to filter malicious payloads targeting the /cgi-bin/cstecgi.cgi URI.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, there is a public exploit available for this vulnerability. The ease of exploitation and the lack of authentication make this a critical threat that necessitates immediate patching.

Analyst Recommendation

Security teams must prioritize the deployment of the latest firmware update to neutralize this vulnerability. Given the availability of public exploits, the window for remediation is narrow, and failure to act may expose the network to unauthorized remote control.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated remote attackers to execute arbitrary commands by manipulating the telnet_enabled argument.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7152

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The flaw resides in the setTelnetCfg function of the /cgi-bin/cstecgi.cgi component, where the telnet_enabled argument fails to sanitize input, enabling remote OS command injection without requiring authentication.

Business Impact

Given the CVSS score of 9.8, this flaw facilitates complete device takeover. Successful exploitation can lead to total loss of control over the router, facilitating man-in-the-middle attacks or lateral movement within the local network, creating significant reputational and security risks.

Remediation Plan

Immediate Action: Update the firmware of the affected Totolink A8000RU device to the latest vendor-supplied version.

Proactive Monitoring: Review system logs for unusual activity originating from the /cgi-bin/cstecgi.cgi endpoint and monitor for unexpected changes to Telnet service configurations.

Compensating Controls: Disable remote management features on the router and implement strict firewall rules to prevent unauthorized access to the CGI interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, exploit code is publicly available. The vulnerability is highly accessible to remote attackers, and organizations should treat this as a high-priority threat to their perimeter security.

Analyst Recommendation

Urgent remediation is required to secure the device against this command injection flaw. Organizations must apply the latest firmware update provided by the vendor to eliminate this vulnerability and prevent potential exploitation by malicious actors.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An OS command injection vulnerability exists in the Totolink A8000RU CGI handler, allowing unauthenticated remote attackers to execute arbitrary system commands via the CsteSystem function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows for unauthenticated remote code execution, posing an immediate risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7140

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the CsteSystem function within the /cgi-bin/cstecgi.cgi component, where improper input validation of the HTTP argument enables remote OS command injection. The attack does not require authentication.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to network infrastructure. Successful exploitation allows an attacker to gain full control over the router, potentially leading to unauthorized network access, data exfiltration, or the redirection of traffic, resulting in severe operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Apply the latest security firmware update provided by Totolink immediately.

Proactive Monitoring: Monitor network traffic and device logs for suspicious HTTP requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those containing shell metacharacters.

Compensating Controls: Restrict access to the device's management interface to trusted IP addresses via a firewall or ACL to prevent external exploitation.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, public exploit code is available for this vulnerability. Given the ease of remote execution and the availability of functional exploits, the potential for active exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize patching the affected Totolink A8000RU devices to mitigate the risk of remote code execution. If patching is not immediately feasible, ensure the management interface is not exposed to the internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the mode parameter in the setWiFiAclRules function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7139

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability affects the setWiFiAclRules function in /cgi-bin/cstecgi.cgi. The mode parameter is not properly sanitized, facilitating remote OS command injection by an unauthenticated attacker.

Business Impact

The device is susceptible to total compromise, which can result in severe network security breaches. The 9.8 CVSS score confirms the high severity and potential for exploitation.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version and disable Wi-Fi ACL rules if not required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes and suspicious command activity.

Compensating Controls: Use a firewall to block all WAN-side access to the management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

Immediate firmware updates are required to mitigate this threat. If a patch is unavailable, isolate the device from external networks to prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the tz parameter in the setNtpCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7138

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setNtpCfg function of the /cgi-bin/cstecgi.cgi file, where the tz parameter can be used to inject and execute OS commands remotely.

Business Impact

An attacker can gain complete control over the device, threatening network security and integrity. The 9.8 CVSS score indicates an extreme level of risk.

Remediation Plan

Immediate Action: Apply the latest firmware update and disable unnecessary NTP configuration settings.

Proactive Monitoring: Monitor router logs for suspicious command execution patterns.

Compensating Controls: Restrict management access to the router via internal network only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to prevent potential exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the sambaEnabled parameter in the setStorageCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7137

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setStorageCfg function within /cgi-bin/cstecgi.cgi due to insufficient sanitization of the sambaEnabled parameter, enabling remote OS command injection.

Business Impact

The flaw grants an attacker full control over the router, which can lead to data breaches or network-wide compromise. The 9.8 CVSS score emphasizes the severity of this risk.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable Samba/storage sharing features if they are not necessary.

Proactive Monitoring: Review system logs for unexpected system-level command execution.

Compensating Controls: Use a firewall to restrict access to the device's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Urgent firmware updates are necessary to secure the device. If an update is not immediately available, disable all unnecessary features and restrict external access to the device.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the wanIdx parameter in the setDmzCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7136

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setDmzCfg function in the /cgi-bin/cstecgi.cgi file. Improper input validation on the wanIdx parameter allows for remote OS command injection.

Business Impact

The vulnerability provides an attacker with complete control over the device, facilitating unauthorized access to the network. The 9.8 CVSS score confirms the high severity and potential for large-scale impact.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable DMZ features if not strictly required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or anomalous process execution.

Compensating Controls: Block WAN-side access to the management interface using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available.

Analyst Recommendation

Immediate remediation is required. Organizations should ensure all Totolink devices are running the latest firmware to protect against this critical threat.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the merge parameter in the setWiFiEasyCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7125

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. The merge parameter is inadequately sanitized, allowing remote command injection by an unauthenticated attacker.

Business Impact

The device is subject to total compromise, which poses a significant threat to internal network security. The 9.8 CVSS score justifies treating this as a high-priority security issue.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the Wi-Fi Easy Configuration feature if possible.

Proactive Monitoring: Review router logs for any suspicious system-level commands being executed.

Compensating Controls: Restrict management interface access to local or trusted administrative subnets only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

All affected users should immediately update their firmware. If a patch is unavailable, the device must be isolated from the WAN to prevent remote exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the addrPrefixLen parameter in the setIpv6LanCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7124

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setIpv6LanCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can supply a malicious addrPrefixLen parameter to trigger OS command injection.

Business Impact

This flaw permits total device takeover, which can lead to severe security breaches, including data exfiltration and denial of service. The 9.8 CVSS score reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the vendor-supplied firmware update and disable IPv6 if it is not currently in use.

Proactive Monitoring: Monitor router logs for anomalous execution attempts or unexpected configuration changes.

Compensating Controls: Use a firewall to block access to the management interface from the WAN side.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to mitigate this critical risk.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability in the Totolink A8000RU CGI handler occurs via the setIptvCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7123

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability affects the setIptvCfg function in the /cgi-bin/cstecgi.cgi file, where improper handling of the setIptvCfg argument allows for remote OS command injection.

Business Impact

This vulnerability allows an attacker to gain full control of the network device. The CVSS score of 9.8 indicates that this is a critical risk, potentially allowing an attacker to reroute traffic or disable security controls.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the IPTV configuration feature if not strictly required.

Proactive Monitoring: Monitor for unusual traffic patterns and unauthorized configuration changes on the router.

Compensating Controls: Implement strict network access control lists (ACLs) to prevent unauthorized access to the router's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this vulnerability highly accessible to malicious actors.

Analyst Recommendation

The severity and exploitability of this vulnerability demand immediate attention. Users should update their firmware to the latest available version and apply recommended network hardening techniques immediately.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the enable parameter in the setUPnPCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7122

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi file. Lack of input sanitization on the enable argument permits remote OS command injection by an unauthenticated user.

Business Impact

The flaw provides an attacker with the ability to execute commands with high privileges on the device. Given the 9.8 CVSS score, this represents a major threat to network integrity, allowing for potential man-in-the-middle attacks or total network traffic interception.

Remediation Plan

Immediate Action: Disable UPnP and remote management features immediately, and apply available firmware updates.

Proactive Monitoring: Review system logs for suspicious process execution or unexpected configuration changes.

Compensating Controls: Use a firewall to block external access to the device's web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability. Urgent remediation is recommended.

Analyst Recommendation

Organizations utilizing the Totolink A8000RU must treat this as a critical security incident. The presence of public exploits necessitates immediate isolation of the device from untrusted networks until a secure firmware version can be deployed.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated attackers to execute arbitrary commands via the wizard parameter.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-7121

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection vulnerability within the setWizardCfg function of the /cgi-bin/cstecgi.cgi component. The application fails to sanitize the wizard argument, allowing an unauthenticated remote attacker to inject and execute arbitrary system commands.

Business Impact

The vulnerability allows for full remote compromise of the device, which could be used as a pivot point into the local network. With a CVSS score of 9.8, the risk of complete device takeover and subsequent lateral movement is severe.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet or apply the latest manufacturer firmware patch if available.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell-like activity originating from the router.

Compensating Controls: Restrict management interface access to trusted IP addresses only via firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, significantly increasing the probability of exploitation. Immediate action is required to secure the device.

Analyst Recommendation

Due to the availability of public exploit code and the critical nature of the vulnerability, immediate mitigation is required. If a firmware update is not available, the device should be isolated from external network access to prevent compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A8000RU router via the pptpPassThru argument in the setVpnPassCfg function.

Executive Summary:
An unauthenticated OS command injection vulnerability in the Totolink A8000RU router allows remote attackers to execute arbitrary system commands, posing a critical risk of total device compromise.

Vulnerability Details

CVE-ID: CVE-2026-7037

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection flaw within the setVpnPassCfg function of the /cgi-bin/cstecgi.cgi component. Attackers can reach this endpoint without authentication to inject malicious commands that run with system-level privileges.

Business Impact

The CVSS score of 9.8 reflects the ease of exploitation and the severity of the impact. Successful exploitation grants an attacker full control over the network device, which can be used to intercept sensitive traffic, pivot into internal network segments, or deploy persistent malware, leading to severe data breaches and operational downtime.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet or restrict access to the management interface to trusted IP addresses only until a firmware patch is applied.

Proactive Monitoring: Inspect system logs for unusual command executions or attempts to access the cstecgi.cgi file from unauthorized external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) configured to block malicious patterns targeting CGI scripts and command injection sequences.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of April 26, 2026, public exploit code is available for this vulnerability. Given the ease of remote execution and the availability of proof-of-concept material, the likelihood of active exploitation is extremely high.

Analyst Recommendation

This vulnerability represents a critical threat to network integrity. Organizations using the Totolink A8000RU should prioritize immediate isolation of the device. If an official firmware update is unavailable, ensure the device is not accessible from the public internet and evaluate replacement options if the vendor does not provide a timely fix.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Totolink A7100RU router contains an OS command injection vulnerability in the setPasswordCfg function, allowing remote unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU router enables remote unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6195

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability exists in the /cgi-bin/cstecgi.cgi file within the CGI handler, where the admpass argument is improperly sanitized. Unauthenticated remote attackers can leverage this flaw to inject and execute system-level commands via the setPasswordCfg function.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for full remote system compromise without authentication. Successful exploitation could lead to total loss of device integrity, unauthorized access to network traffic, and the potential use of the device as a pivot point for lateral movement within the internal network.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware release or consider isolating the affected device from the public internet immediately.

Proactive Monitoring: Review web access logs for suspicious requests directed at /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 13, 2026, public exploit code is available for this vulnerability. Organizations should treat this as an active threat and restrict network access to the affected hardware immediately.

Analyst Recommendation

Due to the critical severity and the existence of public exploit code, this vulnerability represents an imminent threat. Administrators must prioritize updating the firmware or, if no patch is available, moving the device behind a secure VPN or firewall to prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A3002MU Router
AFFECTED_VERSIONS: B20211125.1046
CONFIDENCE: high
MISSING: none
CREDITS: DLChen (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357116","name":"VDB-357116 | Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357116/cti","name":"VDB-357116 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797452","name":"Submit #797452 | TOTOLINK A3002MU A3002MU_Hh-B20211125.1046 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/zhuchan770/vulnerability/blob/main/A3002MU/formWlanSetup/ToToLinkA3002MU%20formWlanSetup%20339996b67c9780caafb2d351dfd8a889.md","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Totolink A3002MU router allows remote attackers to cause memory corruption via the wan-url parameter in the formWlanSetup function.

Executive Summary:
A critical buffer overflow vulnerability in the Totolink A3002MU router allows for potential remote exploitation and memory corruption.

Vulnerability Details

CVE-ID: CVE-2026-6194

Affected Software: Totolink A3002MU Router

Affected Versions: B20211125.1046

Vulnerability: The vulnerability exists in the function sub_410188 within the /boafrm/formWlanSetup endpoint, where the wan-url parameter is processed without sufficient length validation. This results in a stack-based buffer overflow when an attacker provides an overly long string, which is then copied into a fixed-size memory buffer.

Business Impact

The successful exploitation of this vulnerability can lead to memory corruption and potential denial of service conditions, impacting the availability of network infrastructure. While the CVSS score of 8.8 reflects a high severity rating, the ability for remote attackers to trigger this flaw without complex interaction necessitates immediate attention to prevent operational disruption.

Remediation Plan

Immediate Action: Update the device firmware to the latest available version provided by the manufacturer to patch the memory handling flaw.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests targeting the /boafrm/formWlanSetup endpoint, particularly those containing unusually long parameters.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to restrict access to the administrative interface of the router, ensuring only trusted management IPs can interact with vulnerable endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up by the researcher.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional exploit script significantly lowers the barrier for attackers to achieve memory corruption.

Analyst Recommendation

Given the presence of a public proof-of-concept and the potential for remote exploitation, this issue poses a significant risk to affected Totolink devices. Administrators should verify their firmware versions immediately and apply the vendor-supplied security update to mitigate the risk of memory corruption and service disruption.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A7000R
AFFECTED_VERSIONS: A7000R 9.1.0u.6115 and earlier
CONFIDENCE: high
MISSING: patch
CREDITS: DLChen (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357056","name":"VDB-357056 | TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357056/cti","name":"VDB-357056 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797193","name":"Submit #797193 | TOTOLINK A7000R <=V9.1.0u.6115 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/zhuchan770/vulnerability/blob/main/A7000R/setWiFiEasyGuestCfg/ToToLink%20A7000R%20setWiFiEasyGuestCfg%20338996b67c9780b89829d0ea70058788.md","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.855Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TOTOLINK A7000R router allows remote code execution via the ssid5g parameter in the setWiFiEasyGuestCfg function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in TOTOLINK A7000R routers allows remote attackers to compromise device integrity and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-6168

Affected Software: TOTOLINK A7000R

Affected Versions: A7000R 9.1.0u.6115 and earlier

Vulnerability: The vulnerability exists within the setWiFiEasyGuestCfg function of the cstecgi.cgi script, where the ssid5g parameter is processed without proper length validation before being copied into a fixed-size stack buffer. This memory corruption flaw allows a low-privileged authenticated attacker to trigger a stack-based buffer overflow.

Business Impact

The exploitation of this flaw allows an attacker to achieve remote code execution on the affected router. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full device takeover, unauthorized access to internal network traffic, and potential lateral movement into the local environment. Compromise of networking equipment often serves as a primary vector for persistent internal threats and data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the web management interface to trusted internal segments only. If possible, disable the guest wireless configuration features until the vendor releases a firmware update.

Proactive Monitoring: Monitor device logs for unusual crash events or unexpected reboots of the cstecgi.cgi process. Review network traffic for anomalous POST requests directed at the /cgi-bin/cstecgi.cgi endpoint containing oversized ssid5g parameters.

Compensating Controls: Implement an ingress Web Application Firewall (WAF) rule or an Intrusion Prevention System (IPS) signature to inspect and block HTTP requests to the management interface that contain excessively long strings within the ssid5g field.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, because a functional proof-of-concept has been published, the risk of exploitation is elevated and should be considered credible. The vulnerability is highly exploitable due to the lack of input sanitization on the ssid5g parameter.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability, immediate mitigation is required. Organizations utilizing TOTOLINK A7000R devices should prioritize isolating these systems from the public internet and monitoring vendor communication channels for forthcoming firmware updates. Failure to secure these devices may result in total loss of control over the affected network infrastructure.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: 6.1c.1353_B20190305, 6.1c.1390_B20191101
CONFIDENCE: high
MISSING: none
CREDITS: xuanyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357038","name":"VDB-357038 | Totolink N300RH upgrade.so setUpgradeUboot os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357038/cti","name":"VDB-357038 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/796426","name":"Submit #796426 | TOTOLINK N300RH_V4 V6.1c.1353_B20190305 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/02_setUpgradeUboot_RCE","name":null,"tags":["exploit","patch"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
Totolink N300RH routers are vulnerable to unauthenticated OS command injection in the setUpgradeUboot function, allowing remote attackers to execute arbitrary commands with root privileges.

Executive Summary:
A critical, unauthenticated remote code execution vulnerability in Totolink N300RH routers allows attackers to gain full system control via the web management interface.

Vulnerability Details

CVE-ID: CVE-2026-6158

Affected Software: Totolink N300RH

Affected Versions: 6.1c.1353_B20190305, 6.1c.1390_B20191101

Vulnerability: This is an OS command injection vulnerability (CWE-78) located in the setUpgradeUboot handler within the upgrade.so file. An unauthenticated remote attacker can inject shell metacharacters into the FileName parameter during a POST request to /cgi-bin/cstecgi.cgi, which are then executed by the system as root.

Business Impact

Successful exploitation of this vulnerability grants an attacker full root access to the affected router, which can lead to complete device compromise, unauthorized network access, and the potential for the device to be leveraged as a pivot point for further attacks on the internal network. Given the CVSS score of 7.3, this represents a significant risk to organizational infrastructure, particularly where these devices are used to provide edge connectivity.

Remediation Plan

Immediate Action: Update the device firmware to a version beyond V6.1c.1390_B20191101 or apply the latest security patch provided by Totolink. If no patch is available for a specific deployment, isolate the management interface from the public internet immediately.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters like backticks or semicolons in the FileName parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Access Control List (ACL) to restrict access to the router's management interface to known, trusted management IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a functional proof of concept is available via the referenced GitHub repository.

Analyst Notes: As of April 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the use of system-level privileges during the command execution.

Analyst Recommendation

The presence of a public proof of concept and the ability for an unauthenticated attacker to gain root access makes this a high priority for remediation. Administrators should prioritize firmware updates or network-level isolation of the management interface to prevent unauthorized remote execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A800R
AFFECTED_VERSIONS: 4.1.2cu.5137_B20200730
CONFIDENCE: high
MISSING: patch
CREDITS: xuanyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357037","name":"VDB-357037 | Totolink A800R app.so setAppEasyWizardConfig buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357037/cti","name":"VDB-357037 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/793114","name":"Submit #793114 | TOTOLINK A800R V4.1.2cu.5137_B20200730 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/01_Buffer_Overflow_setAppEasyWizardConfig.md","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.859Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the setAppEasyWizardConfig function of Totolink A800R firmware allows remote attackers to trigger memory corruption via the apcliSsid parameter.

Executive Summary:
A critical stack-based buffer overflow in the Totolink A800R router allows remote attackers to cause system crashes or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-6157

Affected Software: Totolink A800R

Affected Versions: 4.1.2cu.5137_B20200730

Vulnerability: The vulnerability exists within the setAppEasyWizardConfig function of the /lib/cste_modules/app.so library. An attacker with low privileges can supply an overly long string to the apcliSsid parameter, which is then copied into a fixed-size stack buffer without bounds checking, resulting in memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity. Successful exploitation could lead to a complete denial of service of the networking device or unauthorized arbitrary code execution, potentially granting an attacker a foothold within the local network. This poses a significant risk to organizational infrastructure, as compromised routers can be used to facilitate man-in-the-middle attacks or provide persistent access to internal resources.

Remediation Plan

Immediate Action: Contact the vendor or consult the official Totolink support portal to determine if a firmware patch is available for the A800R series, as no specific patch version was provided in the current data.

Proactive Monitoring: Review system logs for unexpected reboots, service crashes, or anomalous traffic patterns targeting the /cgi-bin/cstecgi.cgi endpoint.

Compensating Controls: Implement strict access control lists on the management interface to restrict access to trusted administrative IP addresses and employ a Web Application Firewall to inspect and block excessively long input strings in POST requests.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher write-up published on GitHub.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation when processing user-supplied data in the affected interface.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high CVSS severity, this vulnerability presents a credible threat to the integrity and availability of the affected Totolink routers. Administrators should prioritize identifying vulnerable units and applying official vendor firmware updates as soon as they are released. If an update is not immediately available, restrict management access to the device to prevent remote exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU allows remote OS command injection via the setIpQosRules function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU permits remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6156

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setIpQosRules function in /cgi-bin/cstecgi.cgi fails to sanitize the Comment argument, allowing an unauthenticated attacker to inject and execute OS commands.

Business Impact

The CVSS score of 9.8 highlights the critical threat of this vulnerability. Successful exploitation provides the attacker with full control over the device, facilitating further network penetration and data interception.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update immediately to patch the vulnerable CGI function.

Proactive Monitoring: Monitor system logs for unusual behavior or unauthorized command execution.

Compensating Controls: Ensure the router's management interface is not accessible from the public internet by configuring appropriate firewall rules.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploit code is available. The risk of exploitation is extremely high given the remote nature of the flaw.

Analyst Recommendation

Immediate firmware updates are required to mitigate this critical risk. Restricting access to the device management interface is a necessary secondary measure to prevent unauthorized exploitation.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313
---END_METADATA---

Description Summary:
Totolink A7100RU is vulnerable to remote OS command injection via the setWanCfg function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote attackers to execute arbitrary commands with full system privileges.

Vulnerability Details

CVE-ID: CVE-2026-6155

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313

Vulnerability: The setWanCfg function in /cgi-bin/cstecgi.cgi does not properly sanitize the pppoeServiceName argument, allowing for remote OS command injection by an unauthenticated attacker.

Business Impact

A CVSS score of 9.8 signifies a critical risk of full system compromise. Attackers can gain control over network configuration and traffic, potentially leading to man-in-the-middle attacks or full internal network access.

Remediation Plan

Immediate Action: Update to the latest firmware version as provided by Totolink to address the identified command injection vulnerability.

Proactive Monitoring: Monitor for suspicious network configuration changes or unusual outbound traffic from the router.

Compensating Controls: Use firewall rules to block internet-facing access to the device's web management interface.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits are available. The severity and ease of exploitation necessitate immediate action.

Analyst Recommendation

This is a high-priority issue. Administrators should update affected devices immediately and ensure that management interfaces are not exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU allows remote OS command injection via the setWizardCfg function within the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6154

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWizardCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wizard argument, enabling an unauthenticated attacker to inject and execute OS commands.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation grants the attacker full control over the router, which can be used to compromise all traffic passing through the device and potentially infiltrate internal resources.

Remediation Plan

Immediate Action: Install the latest firmware update provided by the vendor to remediate the command injection flaw.

Proactive Monitoring: Review system and audit logs for signs of arbitrary command execution or unauthorized configuration changes.

Compensating Controls: Implement strict firewall rules to prevent external access to the device's CGI management endpoints.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits have been identified. The potential for malicious use is high, and immediate patching is required.

Analyst Recommendation

Administrators must prioritize the firmware update for all affected devices. Until an update is applied, ensure that access to the device is limited to trusted, internal-only networks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU is susceptible to remote OS command injection via the UploadFirmwareFile function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU enables remote, unauthenticated attackers to execute arbitrary commands on the system.

Vulnerability Details

CVE-ID: CVE-2026-6140

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The UploadFirmwareFile function in /cgi-bin/cstecgi.cgi lacks adequate input validation for the FileName argument, permitting remote OS command injection.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete system compromise. Attackers could potentially overwrite firmware or execute malicious code, leading to long-term persistence and unauthorized access to network traffic.

Remediation Plan

Immediate Action: Update to the latest firmware version released by Totolink to address the vulnerability in the CGI handler.

Proactive Monitoring: Monitor logs for unauthorized or suspicious firmware upload attempts.

Compensating Controls: Restrict administrative access to the router's web interface to authorized management subnets only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits are available. The critical severity and remote exploitability demand immediate attention.

Analyst Recommendation

The risk posed by this vulnerability is extreme. It is essential to apply the vendor-provided firmware update immediately and restrict exposure of the web management interface.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU contains an OS command injection vulnerability in the UploadOpenVpnCert function of the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6139

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The UploadOpenVpnCert function in /cgi-bin/cstecgi.cgi does not properly sanitize the FileName argument, facilitating remote OS command injection by an unauthenticated attacker.

Business Impact

The CVSS score of 9.8 highlights the critical nature of this vulnerability. Compromise of the router allows for full control of the network gateway, potentially leading to widespread data interception and lateral movement into the internal corporate environment.

Remediation Plan

Immediate Action: Patch the device by installing the most recent firmware update from the manufacturer.

Proactive Monitoring: Monitor for anomalous traffic patterns or unexpected file uploads related to OpenVPN certificate management.

Compensating Controls: Disable unnecessary management services or restrict access to the web interface via network access control lists.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploits are available for this vulnerability, significantly increasing the likelihood of successful exploitation.

Analyst Recommendation

Immediate remediation is required to secure the device against remote command execution. Administrators should prioritize firmware updates and ensure the device is not reachable from untrusted networks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU is vulnerable to remote OS command injection via the setAccessDeviceCfg function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU permits remote attackers to execute arbitrary commands with administrative privileges.

Vulnerability Details

CVE-ID: CVE-2026-6138

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setAccessDeviceCfg function within /cgi-bin/cstecgi.cgi fails to sanitize the mac argument, allowing unauthenticated remote attackers to inject and execute OS commands.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat. Successful exploitation allows for complete control over the affected hardware, enabling attackers to intercept traffic, modify configurations, or deploy malicious payloads within the network.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by Totolink to patch the vulnerable CGI handler.

Proactive Monitoring: Review system logs for unexpected execution of shell commands or unauthorized configuration changes.

Compensating Controls: Implement an ingress firewall policy to block unauthorized access to the web management interface of the router.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 13, 2026, public exploit material is available. The ease of triggering this command injection necessitates immediate patching.

Analyst Recommendation

Given the availability of public exploits, the urgency for remediation is high. All affected Totolink devices must be updated to the latest available firmware to mitigate the risk of remote command execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Totolink A7100RU allows remote unauthenticated attackers to execute arbitrary OS commands via the setLedCfg function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6132

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability exists in the setLedCfg function of /cgi-bin/cstecgi.cgi, where the enable argument is not properly sanitized, leading to OS command injection by an unauthenticated attacker.

Business Impact

The CVSS score of 9.8 reflects the high probability of total device takeover. An attacker can gain persistent access, pivot into internal networks, or participate in botnet activities, leading to severe security breaches and potential loss of network integrity.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update immediately to address the command injection flaw.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell-like activity originating from the device.

Compensating Controls: Restrict access to the device's management interface to trusted internal IP addresses only via firewall rules.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. Given the ease of remote exploitation, the risk of active compromise is extremely high.

Analyst Recommendation

This is a critical vulnerability with active public exploits. It is imperative that affected devices are updated immediately. If an update cannot be applied, the device should be isolated from the public internet to prevent exploitation.

---METADATA---
VENDOR: Acer
PRODUCT: Totolink A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
Acer Totolink A7100RU is vulnerable to remote OS command injection via the setTracerouteCfg function in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Acer Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary commands on the system.

Vulnerability Details

CVE-ID: CVE-2026-6131

Affected Software: Acer Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setTracerouteCfg function in /cgi-bin/cstecgi.cgi lacks proper input validation on the command argument, enabling an unauthenticated attacker to perform OS command injection.

Business Impact

With a CVSS score of 9.8, this vulnerability allows for complete device control. This could lead to unauthorized access to the local area network, interception of sensitive data, and potential use of the device in larger-scale attacks.

Remediation Plan

Immediate Action: Install the latest firmware update provided by Acer/Totolink to resolve this command injection vulnerability.

Proactive Monitoring: Monitor for unusual traceroute or diagnostic requests and unexpected system command execution.

Compensating Controls: Restrict access to the router's web-based management interface to authorized administrative workstations.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploits are available. The remote nature of the vulnerability makes it a high-priority threat.

Analyst Recommendation

Immediate remediation is essential. Administrators must update the device firmware and limit exposure of the management interface to mitigate the risk of remote command execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the ip argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-6116

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setDiagnosisCfg function in /cgi-bin/cstecgi.cgi, where the ip argument is not properly sanitized, permitting unauthenticated remote OS command injection.

Business Impact

A CVSS score of 9.8 indicates a critical risk. An attacker can use this vulnerability to gain full administrative control over the router, resulting in potential data theft, network disruption, and lateral movement within the organization.

Remediation Plan

Immediate Action: Update the router firmware to the latest version.

Proactive Monitoring: Monitor logs for unauthorized access or suspicious activity on the device's web management interface.

Compensating Controls: If patching is delayed, disable the web management interface or restrict access via firewall rules to known safe IP addresses.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high, requiring immediate attention.

Analyst Recommendation

This vulnerability presents a severe risk to network security. Organizations should ensure that all affected Totolink hardware is updated to the latest firmware release as a matter of urgency.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the enable argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router creates a critical risk of unauthorized remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6115

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setAppCfg function in /cgi-bin/cstecgi.cgi contains an input sanitization flaw in the enable argument, which can be leveraged by an unauthenticated attacker to execute OS commands.

Business Impact

The CVSS score of 9.8 highlights the critical nature of this vulnerability. Successful exploitation grants the attacker full control over the router, enabling persistent access and the ability to launch further attacks against the internal network.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update immediately.

Proactive Monitoring: Analyze network traffic for unusual patterns or external connections originating from the router.

Compensating Controls: Restrict management access to the router to trusted, local network segments only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high, and immediate action is required.

Analyst Recommendation

Administrators must treat this as a high-priority incident. Apply the necessary firmware updates to mitigate the risk of remote command execution and potential network-wide compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the proto argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router enables unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6114

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setNetworkCfg function in /cgi-bin/cstecgi.cgi fails to properly sanitize the proto argument, allowing an unauthenticated attacker to inject and execute arbitrary OS commands.

Business Impact

The CVSS score of 9.8 reflects the high probability and impact of this vulnerability. Compromise of the router allows for total network visibility and control, posing a dire risk to the confidentiality, integrity, and availability of all connected systems.

Remediation Plan

Immediate Action: Update the device to the most recent firmware version available from the manufacturer.

Proactive Monitoring: Monitor for anomalous system behavior and unauthorized configuration changes on the router.

Compensating Controls: Disable remote management interfaces and restrict access to the device's web management console to authorized personnel only.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high; patching is mandatory.

Analyst Recommendation

This is a critical vulnerability that can be exploited remotely by unauthenticated attackers. Security teams must prioritize updating affected devices and limiting exposure to untrusted networks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the ttyEnable argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-6113

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability resides in the setTtyServiceCfg function in /cgi-bin/cstecgi.cgi. An unauthenticated attacker can manipulate the ttyEnable argument to trigger OS command injection.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. An attacker can compromise the device to intercept traffic, conduct man-in-the-middle attacks, or pivot into the internal network, leading to severe reputational and security consequences for the organization.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by the vendor to remediate the vulnerable CGI handler.

Proactive Monitoring: Review web server logs for suspicious CGI requests containing command-line injection patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent ingress filtering to block malicious requests directed at /cgi-bin/cstecgi.cgi.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of exploitation is high, requiring urgent attention from security teams.

Analyst Recommendation

Given the critical severity and the availability of public exploits, this vulnerability must be addressed immediately. Ensure all vulnerable routers are updated and isolated from public access where possible.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler via the maxRtrAdvInterval argument.

Executive Summary:
A remote OS command injection vulnerability in the Totolink A7100RU router poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-6112

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability exists in the setRadvdCfg function within /cgi-bin/cstecgi.cgi. An unauthenticated attacker can inject arbitrary OS commands by manipulating the maxRtrAdvInterval argument.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code with elevated privileges on the affected device. Given the CVSS score of 9.8, this vulnerability presents a critical threat, potentially leading to unauthorized network access, data exfiltration, or the inclusion of the device in a botnet, causing significant operational downtime.

Remediation Plan

Immediate Action: Update the affected device firmware to the latest available version provided by the manufacturer.

Proactive Monitoring: Inspect system and firewall logs for unusual outbound traffic or unexpected command execution patterns originating from the router's management interface.

Compensating Controls: Restrict access to the router’s management interface to trusted internal IP addresses and disable remote administration features until the patch is applied.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Apr 12, 2026, public exploit code is available for this vulnerability. The risk of active exploitation is high; immediate patching is required.

Analyst Recommendation

The presence of a public exploit for a critical command injection flaw necessitates immediate remediation. Administrators should prioritize updating the affected Totolink routers and ensuring that management interfaces are not exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setVpnAccountCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary code via manipulated user arguments.

Vulnerability Details

CVE-ID: CVE-2026-6029

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the User argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is severe. Successful exploitation allows for complete takeover of the router, potentially leading to network-wide surveillance or the redirection of traffic to malicious destinations.

Remediation Plan

Immediate Action: Update the firmware of all affected Totolink A7100RU devices to the latest available version.

Proactive Monitoring: Inspect router logs for anomalous entries in the setVpnAccountCfg function and unusual administrative activity.

Compensating Controls: Restrict access to the router's web management interface to trusted internal segments only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

Given the public availability of an exploit, this vulnerability poses an imminent threat. Organizations must prioritize firmware updates to mitigate the risk of remote system control.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU router is vulnerable to remote OS command injection in the setPptpServerCfg function, which is publicly exploitable.

Executive Summary:
A critical remote command injection vulnerability in Totolink A7100RU routers allows unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-6028

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file. Attackers can manipulate the enable argument to execute system commands remotely without authentication.

Business Impact

With a CVSS score of 9.8, the impact is catastrophic. An attacker can gain full control over the networking device, facilitating man-in-the-middle attacks, data interception, and persistence within the local network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink to the affected A7100RU devices.

Proactive Monitoring: Monitor network traffic for suspicious cgi-bin activity and unexpected outbound connections from the router.

Compensating Controls: Disable remote management interfaces on the router and ensure it is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, the exploit has been disclosed publicly and may be actively used by threat actors. Immediate action is required.

Analyst Recommendation

The availability of a public exploit significantly increases the risk of this vulnerability. Administrators must update affected hardware immediately to prevent compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute commands via the enable argument in setUrlFilterRules.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, leading to full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6027

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setUrlFilterRules function in /cgi-bin/cstecgi.cgi. An unauthenticated attacker can trigger command injection by manipulating the enable argument.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an extreme risk. Successful exploitation allows for complete takeover of the router, potentially leading to widespread data interception, unauthorized network access, and the deployment of persistent malware on the device.

Remediation Plan

Immediate Action: Update the device firmware to the latest version to patch the vulnerable CGI handler.

Proactive Monitoring: Maintain vigilance for anomalous device behavior and audit all management interface logs for unauthorized access attempts.

Compensating Controls: Implement network-level segmentation to isolate the management interface and use a WAF to block requests containing malicious command payloads.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. Because this vulnerability is remotely triggerable without authentication, it poses a severe threat to any internet-facing device.

Analyst Recommendation

Immediate action is mandatory to mitigate this critical vulnerability. Administrators should apply the vendor's firmware update as soon as possible and ensure that no vulnerable devices remain exposed to the public internet.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler, allowing unauthenticated attackers to execute commands via the enable argument in setPortalConfWeChat.

Executive Summary:
A critical remote OS command injection flaw in the Totolink A7100RU router allows unauthenticated attackers to execute arbitrary commands, threatening network integrity.

Vulnerability Details

CVE-ID: CVE-2026-6026

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability is located in the setPortalConfWeChat function of the /cgi-bin/cstecgi.cgi component. Unauthenticated remote attackers can perform OS command injection by manipulating the enable argument.

Business Impact

The CVSS score of 9.8 justifies the classification of this vulnerability as critical. Successful exploitation provides attackers with arbitrary code execution capabilities, which can be leveraged to compromise the device, perform man-in-the-middle attacks, or facilitate further unauthorized access to the protected network.

Remediation Plan

Immediate Action: Update the affected Totolink A7100RU devices to the latest firmware provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for suspicious requests to the CGI handler and review device logs for signs of unauthorized configuration changes or command execution.

Compensating Controls: Restrict management interface access to trusted networks and monitor for unauthorized attempts to invoke the vulnerable CGI function.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available. The ability for unauthenticated remote attackers to trigger this command injection makes it an urgent security priority.

Analyst Recommendation

Given the critical severity and the existence of public exploits, immediate remediation is required. Organizations should ensure all affected hardware is updated to the latest available firmware to mitigate this high-risk vulnerability.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated remote attackers to execute arbitrary commands via the enable argument in setSyslogCfg.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router enables unauthenticated attackers to achieve full system execution.

Vulnerability Details

CVE-ID: CVE-2026-6025

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability affects the setSyslogCfg function within /cgi-bin/cstecgi.cgi. Unauthenticated attackers can inject operating system commands by manipulating the enable parameter.

Business Impact

A CVSS score of 9.8 reflects the high severity of this command injection flaw. Successful exploitation allows an attacker to bypass authentication, execute arbitrary code, and potentially exfiltrate logs or sensitive configuration data, resulting in a significant security breach and loss of device control.

Remediation Plan

Immediate Action: Apply the vendor-provided firmware update to resolve the command injection vulnerability in the CGI handler.

Proactive Monitoring: Inspect system logs for unexpected execution of system commands or unusual traffic patterns associated with the syslog configuration component.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent inspection tool to filter malicious payloads containing shell metacharacters from requests targeting the CGI interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available for this vulnerability. The ease of triggering this flaw remotely makes it a prime target for automated exploitation tools.

Analyst Recommendation

The risk posed by this vulnerability is critical. Security teams must prioritize patching or isolating the affected A7100RU devices to prevent potential compromise and unauthorized access to the underlying operating system.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A7100RU CGI handler allows unauthenticated attackers to execute arbitrary system commands via the admpass argument.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router allows unauthenticated attackers to gain full control of the device.

Vulnerability Details

CVE-ID: CVE-2026-5997

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability resides in the setLoginPasswordCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can trigger OS command injection by manipulating the admpass argument.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to network security. An attacker achieving command injection can modify administrative credentials, reconfigure security settings, or use the device as a persistent beachhead for further attacks, leading to total loss of control over the affected network segment.

Remediation Plan

Immediate Action: Update the device to the latest available firmware version provided by the manufacturer.

Proactive Monitoring: Review system configuration logs for unauthorized changes to administrative accounts or suspicious web requests targeting the CGI handler.

Compensating Controls: Disable remote management features on the router and ensure the device is not accessible from the public internet until the patch is applied.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code is available, making this a high-risk entry point for attackers. Immediate mitigation is required as the vulnerability allows for unauthenticated remote system command execution.

Analyst Recommendation

Given the critical nature of this flaw and the availability of functional exploits, remediation should be treated as an emergency task. Administrators must ensure all vulnerable units are updated to a secure firmware version to maintain the integrity of the network infrastructure.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability exists in the Totolink A7100RU CGI handler, allowing unauthenticated attackers to execute arbitrary system commands via the tty_server argument.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU router poses an immediate risk of full device compromise by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-5996

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability located within the setAdvancedInfoShow function of the /cgi-bin/cstecgi.cgi component. The flaw allows an unauthenticated remote attacker to inject malicious commands via the tty_server parameter.

Business Impact

Successful exploitation results in arbitrary code execution with root-level privileges on the network gateway. Given the CVSS score of 9.8, this vulnerability allows for complete system takeover, potential interception of sensitive network traffic, and lateral movement into the internal network, representing a severe risk to organizational data integrity and confidentiality.

Remediation Plan

Immediate Action: Apply the latest vendor-supplied firmware update immediately to patch the vulnerable CGI handler.

Proactive Monitoring: Monitor network traffic for anomalous outbound connections from the gateway and audit system logs for unexpected execution of shell commands.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface to trusted administrative IP addresses only, effectively mitigating remote exploitation attempts.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploit code for this vulnerability is available, significantly increasing the probability of active exploitation. Organizations must prioritize patching or isolating affected devices from the internet immediately.

Analyst Recommendation

The severity of this flaw, combined with the availability of public exploit material, necessitates an immediate response. Network administrators should verify the firmware version of all Totolink A7100RU devices and apply updates without delay to prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setMiniuiHomeInfoShow function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the lan_info parameter.

Vulnerability Details

CVE-ID: CVE-2026-5995

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi fails to sanitize the lan_info argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 represents a critical risk. Attackers can leverage this to gain full control over the router, potentially compromising all traffic passing through the device.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update.

Proactive Monitoring: Monitor network and device logs for suspicious activity.

Compensating Controls: Restrict device management access to trusted local networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

All Totolink A7100RU devices must be updated immediately to the latest firmware to prevent unauthorized remote command execution and potential system compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setTelnetCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the telnet_enabled parameter.

Vulnerability Details

CVE-ID: CVE-2026-5994

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setTelnetCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the telnet_enabled argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 signifies a critical risk of full device compromise. Attackers can gain root-level access to the router, enabling total control over the device and connected network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink.

Proactive Monitoring: Monitor system logs for unauthorized access or command execution attempts.

Compensating Controls: Disable Telnet and remote management access on the device.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

Update Totolink A7100RU firmware immediately to mitigate this critical command injection vulnerability and prevent unauthorized remote access.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiGuestCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability Details

CVE-ID: CVE-2026-5993

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business Impact

The CVSS score of 9.8 reflects a critical security risk. Exploitation allows for complete takeover of the router, potentially exposing internal network traffic and credentials.

Remediation Plan

Immediate Action: Update to the latest firmware version released by the manufacturer.

Proactive Monitoring: Monitor for unauthorized configuration changes or abnormal system behavior.

Compensating Controls: Restrict management interface access to trusted internal networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 10, 2026, public exploits are available for this vulnerability. The risk of exploitation is high.

Analyst Recommendation

Immediate firmware updates are required to secure Totolink A7100RU devices against this critical command injection flaw.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiAclRules function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the mode parameter.

Vulnerability Details

CVE-ID: CVE-2026-5978

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiAclRules function in /cgi-bin/cstecgi.cgi fails to sanitize the mode argument, allowing remote command injection.

Business Impact

The CVSS score of 9.8 signifies a critical risk. Successful exploitation allows an attacker to seize control of the router, leading to potential data interception and lateral network movement.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update.

Proactive Monitoring: Review system logs for suspicious activity and unauthorized command execution.

Compensating Controls: Disable remote access to the web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available. The risk of exploitation is critical.

Analyst Recommendation

All Totolink A7100RU units must be updated immediately to the latest firmware to prevent unauthorized remote command execution.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setWiFiBasicCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the wifiOff parameter.

Vulnerability Details

CVE-ID: CVE-2026-5977

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setWiFiBasicCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the wifiOff argument, enabling remote OS command injection.

Business Impact

With a CVSS score of 9.8, this flaw allows for total system compromise. Attackers can gain persistent access, manipulate network settings, and compromise the security of all devices connected to the router.

Remediation Plan

Immediate Action: Update the device firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor the router for unauthorized configuration changes or anomalous traffic patterns.

Compensating Controls: Isolate the management interface from the public internet using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits exist for this vulnerability. The risk of exploitation is high and immediate action is required.

Analyst Recommendation

Immediate firmware updates are required for all Totolink A7100RU units to mitigate this critical command injection risk. Failure to patch leaves the device fully vulnerable to remote takeover.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setStorageCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical remote OS command injection vulnerability in the Totolink A7100RU allows unauthenticated attackers to execute arbitrary commands via the sambaEnabled parameter.

Vulnerability Details

CVE-ID: CVE-2026-5976

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setStorageCfg function in /cgi-bin/cstecgi.cgi improperly handles the sambaEnabled argument. An attacker can exploit this to inject and execute arbitrary OS commands remotely.

Business Impact

The CVSS score of 9.8 indicates a critical risk. Successful exploitation grants the attacker full control over the affected hardware, which can be used to exfiltrate data, monitor network traffic, or serve as a launchpad for further network attacks.

Remediation Plan

Immediate Action: Update the device to the latest available firmware provided by the vendor.

Proactive Monitoring: Monitor system logs for unexpected execution of shell commands or configuration changes.

Compensating Controls: Restrict access to the device's web management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits are available and actively being used in the wild. The risk of exploitation is critical.

Analyst Recommendation

Due to the availability of public exploits and the severity of the command injection, immediate firmware updates are required to secure affected Totolink A7100RU devices against remote compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU CGI Handler contains an OS command injection vulnerability in the setDmzCfg function, allowing remote attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5975

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setDmzCfg function within the /cgi-bin/cstecgi.cgi component fails to sanitize the wanIdx argument. This flaw allows a remote attacker to inject and execute arbitrary operating system commands with elevated privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability allows complete device takeover. An attacker can gain persistent access to the router, intercept network traffic, and use the device as a pivot point to attack other systems on the internal network.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink for the A7100RU.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempted management interface access from unknown sources.

Compensating Controls: Disable remote management access on the WAN interface and ensure the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 9, 2026, public exploits for this vulnerability are available. The risk of exploitation is extremely high, and immediate action is required to secure the device.

Analyst Recommendation

This is a critical vulnerability that allows for full device compromise. Given the availability of public exploits, all affected Totolink A7100RU devices should be updated or isolated from the network immediately to prevent unauthorized access.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setWiFiEasyCfg function, specifically through the merge argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5854

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability in the setWiFiEasyCfg function of the CGI handler, where the merge argument is not properly sanitized, allowing remote unauthenticated attackers to execute commands.

Business Impact

The severity of this flaw (CVSS 9.8) means an attacker can gain complete control over the device, leading to significant security risks including data theft, network interception, and further compromise of the local environment.

Remediation Plan

Immediate Action: Deploy the latest firmware update provided by Totolink to remediate the vulnerability.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or attempts to interact with the CGI handler.

Compensating Controls: Block external access to the device’s administrative CGI endpoints using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, significantly increasing the probability of exploitation.

Analyst Recommendation

Prompt firmware updates are critical for all Totolink A7100RU devices. Given the existence of public exploits, organizations should prioritize this remediation to maintain the security and integrity of their network infrastructure.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is vulnerable to remote OS command injection via the setIpv6LanCfg function, exploitable through the addrPrefixLen argument in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-5853

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The setIpv6LanCfg function within the CGI handler fails to sanitize user input for the addrPrefixLen parameter, leading to an OS command injection vulnerability accessible to unauthenticated remote attackers.

Business Impact

Successful exploitation results in full control of the device, enabling the attacker to manipulate network traffic and pivot into the internal network. The 9.8 CVSS score reflects the high severity of this remote, unauthenticated access vector.

Remediation Plan

Immediate Action: Update the affected device to the latest firmware version provided by the manufacturer.

Proactive Monitoring: Review system logs for suspicious activity and monitor for unexpected changes to IPv6 settings.

Compensating Controls: Restrict management access to the device to a dedicated, secure management VLAN or trusted local IP addresses.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability, necessitating immediate attention to prevent exploitation.

Analyst Recommendation

Given the high-risk nature of this vulnerability and the availability of public exploits, immediate firmware updates are essential. Administrators should treat this as a high-priority remediation task for all deployed A7100RU units.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU allows remote OS command injection via the setIptvCfg function by manipulating the igmpVer argument in the CGI handler.

Executive Summary:
A critical OS command injection flaw in Totolink A7100RU routers permits remote, unauthenticated attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-5852

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability occurs in the setIptvCfg function of the CGI handler. An unauthenticated remote attacker can supply a malicious payload in the igmpVer argument to trigger OS command injection.

Business Impact

The ability to execute arbitrary commands remotely on a network device leads to total compromise of the device's functionality. This could lead to redirection of traffic, man-in-the-middle attacks, and unauthorized access to protected internal resources, justifying the 9.8 CVSS score.

Remediation Plan

Immediate Action: Apply the latest vendor-provided firmware update to address the vulnerability in the CGI handler.

Proactive Monitoring: Monitor for anomalous traffic patterns and unexpected system configuration changes within the router's logs.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent filtering to inspect and block malicious CGI requests directed at the router.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code exists, significantly increasing the risk of active exploitation.

Analyst Recommendation

Urgent patching is required for all Totolink A7100RU devices. Administrators should ensure the latest firmware is deployed to mitigate the risk of remote command execution and potential network-wide compromise.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU is susceptible to remote OS command injection via the setUPnPCfg function, specifically through the enable parameter in the CGI handler.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU allows remote, unauthenticated attackers to execute arbitrary commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2026-5851

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi component. An unauthenticated attacker can manipulate the enable parameter to inject and execute arbitrary OS commands.

Business Impact

This vulnerability enables full remote control of the affected device, potentially exposing the entire local area network to unauthorized surveillance or data exfiltration. With a CVSS score of 9.8, the impact includes total loss of device integrity and potential compromise of connected internal assets.

Remediation Plan

Immediate Action: Update the device firmware to the latest version supplied by the vendor to eliminate the command injection vector.

Proactive Monitoring: Review system logs for suspicious process spawning and monitor for unexpected changes to the UPnP configuration.

Compensating Controls: Disable UPnP and restrict access to the web management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available. The ease of remote exploitation makes this a high-priority threat.

Analyst Recommendation

Given the availability of public exploits and the critical nature of command injection, users must prioritize firmware remediation. Ensure all Totolink A7100RU devices are patched to prevent remote code execution attacks.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
---END_METADATA---

Description Summary:
The Totolink A7100RU contains an OS command injection vulnerability in the setVpnPassCfg function, allowing remote attackers to execute arbitrary system commands via the pptpPassThru parameter.

Executive Summary:
A critical OS command injection vulnerability in Totolink A7100RU routers allows remote, unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5850

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This is an OS command injection vulnerability within the CGI handler’s setVpnPassCfg function. An unauthenticated remote attacker can inject malicious commands through the pptpPassThru argument.

Business Impact

Successful exploitation grants an attacker complete control over the affected network device. This facilitates unauthorized access to internal network traffic, potential interception of sensitive data, and the establishment of a persistent foothold for further lateral movement within the corporate environment. Given the CVSS score of 9.8, this poses a severe risk to organizational confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by Totolink immediately to patch the vulnerable CGI handler.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the router and inspect system logs for anomalous command execution patterns.

Compensating Controls: Implement strict firewall rules to restrict access to the device's administrative interface and CGI endpoints from untrusted external networks.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 9, 2026, public exploit code is available for this vulnerability. The risk of active exploitation is high; immediate patching is required.

Analyst Recommendation

The presence of a publicly available exploit for this critical command injection flaw necessitates immediate action. Administrators must prioritize updating the firmware on all exposed A7100RU units to prevent unauthorized system access and potential full device takeover.

---METADATA---
VENDOR: Totolink
PRODUCT: A3300R
AFFECTED_VERSIONS: 17.0.0cu.557_b20221024
CONFIDENCE: high
MISSING: patch
CREDITS: LvHW (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354244","name":"VDB-354244 | Totolink A3300R cstecgi.cgi setSyslogCfg command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354244/cti","name":"VDB-354244 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/779145","name":"Submit #779145 | Totolink A3300R 17.0.0cu.557_b20221024 Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/LvHongW/Vuln-of-totolink_A3300R/tree/main/A3300R_rtLogServer_cmd_inject","name":null,"tags":["exploit"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A command injection vulnerability in the setSyslogCfg function of the Totolink A3300R router allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted HTTP request.

Executive Summary:
A critical command injection vulnerability in Totolink A3300R routers allows unauthenticated remote attackers to execute arbitrary system commands, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-5176

Affected Software: Totolink A3300R

Affected Versions: 17.0.0cu.557_b20221024

Vulnerability: The vulnerability exists within the setSyslogCfg function in the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can supply a malicious payload in the rtLogServer parameter, which is improperly sanitized before being passed to a system execution function, resulting in command injection.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized remote control over the affected router. This can lead to complete device compromise, unauthorized access to internal network traffic, and the potential for the router to be leveraged as a pivot point for further attacks against internal assets, potentially resulting in significant data breaches or service disruption. The CVSS score of 7.3 reflects the high risk associated with remote, unauthenticated access.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict management interface access to trusted IP addresses only and disable remote administration features until the vendor releases a firmware update.

Proactive Monitoring: Review system and web access logs for unusual POST requests targeting /cgi-bin/cstecgi.cgi, specifically looking for shell-related characters or command execution patterns in the rtLogServer parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to block or flag requests containing suspicious command injection patterns directed at the cstecgi.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication to reach the vulnerable endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to affected Totolink devices. Organizations should prioritize restricting network access to the device management interface immediately. Monitor the vendor support site closely for firmware updates and apply them as soon as they become available to remediate the underlying flaw.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T09:01:02.383Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control flaw in the TOTOLINK T6 guest_wifi_sync function allows unauthenticated attackers to disable guest virtual AP interfaces using crafted MQTT messages.

Executive Summary:
A critical access control vulnerability in the TOTOLINK T6 router enables unauthenticated attackers to remotely disrupt guest network connectivity.

Vulnerability Details

CVE-ID: CVE-2026-51743

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This is an improper access control vulnerability located in the guest_wifi_sync function. An unauthenticated attacker can send a malicious MQTT message to the cs_broker component to disable guest virtual access points.

Business Impact

The ability for an unauthenticated attacker to remotely disable network interfaces poses a significant risk to service availability and operational continuity. Given the CVSS score of 9.1, this vulnerability indicates a high potential for unauthorized administrative control over network settings, which could be leveraged to disrupt business operations or facilitate further network compromise.

Remediation Plan

Immediate Action: Monitor vendor communication channels for a firmware update that addresses the guest_wifi_sync access control issue. If an update is not available, isolate the cs_broker component or disable guest Wi-Fi features until a patch is released.

Proactive Monitoring: Review network traffic logs for suspicious or malformed MQTT messages directed toward the device, specifically those targeting the cs_broker component.

Compensating Controls: Implement strict network segmentation and ensure the router management interface is not accessible from the public internet to mitigate the risk of remote exploitation.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit exists in the available data).

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its network-adjacent, unauthenticated attack vector.

Analyst Recommendation

This vulnerability represents a severe risk to the availability of TOTOLINK T6 devices. Administrators must prioritize restricting external access to the device management and messaging services immediately. Apply any forthcoming firmware patches from the vendor as soon as they become available to permanently remediate this access control failure.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:01:32.291Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
TOTOLINK T6 routers contain an incorrect access control vulnerability in the delWiFiAclRules function, allowing unauthenticated attackers to remove Wi-Fi ACL rules via crafted POST requests.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to bypass security restrictions and modify network configurations.

Vulnerability Details

CVE-ID: CVE-2026-51730

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the delWiFiAclRules function, where insufficient access control checks permit an unauthenticated attacker to execute unauthorized actions by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Business Impact

The ability for an unauthenticated attacker to manipulate Wi-Fi Access Control List (ACL) rules poses a significant threat to network security. By removing these rules, an attacker can bypass established security policies, potentially granting unauthorized users access to the internal network. Given the CVSS score of 9.1, this vulnerability represents a high-severity risk that could lead to unauthorized network access and potential data exposure.

Remediation Plan

Immediate Action: Review vendor documentation for firmware updates that address ACL control vulnerabilities and apply the latest available version provided by TOTOLINK.

Proactive Monitoring: Inspect web server access logs for suspicious POST requests targeting /cgi-bin/cstecgi.cgi or evidence of unauthorized modifications to Wi-Fi ACL settings.

Compensating Controls: Restrict access to the router management interface by ensuring it is not exposed to the public internet and by utilizing network segmentation to isolate management traffic from untrusted zones.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and the ability for remote, unauthenticated actors to modify core network security policies.

Analyst Recommendation

Due to the critical nature of this vulnerability and the ease of exploitation, administrators should treat this as a high-priority item. If a vendor-supplied patch is not yet available for your specific build, restrict access to the device management interface immediately to prevent remote exploitation attempts.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:42.649Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control flaw in the TOTOLINK T6 delDevice function allows unauthenticated attackers to delete managed slave devices via crafted POST requests.

Executive Summary:
The TOTOLINK T6 router contains a critical access control vulnerability that enables unauthenticated attackers to perform unauthorized device management actions.

Vulnerability Details

CVE-ID: CVE-2026-51729

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability involves incorrect access control within the delDevice function, which is reachable via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated attacker can trigger this function to delete managed slave devices without requiring any administrative credentials.

Business Impact

The ability for an unauthenticated attacker to arbitrarily delete managed slave devices presents a significant risk to network availability and integrity. Successful exploitation could lead to denial of service for connected network segments and disrupt critical infrastructure operations. Given the CVSS score of 9.1, this vulnerability is categorized as critical due to the ease of remote access and the high impact on operational control.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal to verify if a firmware update exists for the T6 model and apply it immediately. If no patch is currently available, restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi, specifically those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict firewall rules to block external access to the device management interface, ensuring that administrative functions are only accessible from secure, internal management VLANs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a published proof of concept for this vulnerability. The flaw is inherently exploitable because it lacks any authentication checks on a sensitive administrative function.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of authentication required to trigger the deletion of slave devices, immediate action is required. Organizations utilizing the TOTOLINK T6 should isolate the management interface from the public internet and contact the vendor for guidance on available firmware updates to mitigate this risk.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:01:24.942Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the TOTOLINK T6 NTPSyncWithHost function allows unauthenticated attackers to modify the system clock via a crafted POST request.

Executive Summary:
A critical access control flaw in the TOTOLINK T6 router allows unauthenticated remote attackers to manipulate device time settings, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-51725

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the NTPSyncWithHost function, which fails to perform proper authentication checks. An unauthenticated attacker can exploit this by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint to alter the device clock.

Business Impact

Successful exploitation allows an attacker to manipulate the device clock, which can be leveraged to bypass time-based security controls, disrupt logging accuracy, or interfere with certificate validation processes. Given the CVSS score of 9.1, this vulnerability is classified as critical due to the ease of exploitation over the network without requiring any prior authentication.

Remediation Plan

Immediate Action: Consult the TOTOLINK support portal for available firmware updates and apply the latest version immediately to patch the affected function.

Proactive Monitoring: Review web server and access logs for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network access control lists to ensure the management interface of the T6 device is not exposed to the public internet, and utilize a Web Application Firewall to block unauthorized POST requests to the identified CGI script.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it is fully automatable and requires no user interaction or privileges to execute.

Analyst Recommendation

This vulnerability presents a high risk to network infrastructure due to the lack of required authentication for exploitation. Administrators must prioritize restricting access to the device management interface and should apply vendor-provided firmware updates as soon as they become available to eliminate the underlying flaw.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:58.635Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An unauthenticated access control vulnerability in the TOTOLINK T6 router allows attackers to redirect device traffic to an upstream Wi-Fi network via a crafted POST request.

Executive Summary:
A critical vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to hijack network traffic by manipulating device configuration settings.

Vulnerability Details

CVE-ID: CVE-2026-51722

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This is an improper access control vulnerability located in the setWiFiRepeaterCfg function. Unauthenticated attackers can exploit this flaw by sending a malicious POST request to the /cgi-bin/cstecgi.cgi endpoint to reconfigure the device upstream connection.

Business Impact

Successful exploitation of this vulnerability allows an attacker to intercept or redirect network traffic, leading to significant risk of data theft, credential harvesting, and man-in-the-middle attacks. Given the CVSS score of 9.1, this flaw represents a critical threat to organizational network integrity that could facilitate widespread unauthorized access to internal communications.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal to determine if a firmware update addressing this specific configuration vulnerability is available for the T6 model.

Proactive Monitoring: Monitor network traffic logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi and investigate any unauthorized changes to Wi-Fi repeater or upstream network settings.

Compensating Controls: Restrict administrative access to the web management interface to trusted internal IP addresses only, and disable the Wi-Fi repeater functionality if it is not required for current business operations.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit available in the provided data).

Analyst Notes: As of September 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The ability to manipulate core network routing without authentication makes this device highly susceptible to remote traffic redirection.

Analyst Recommendation

Due to the critical nature of this vulnerability and the existence of proof-of-concept material, administrators should prioritize securing affected TOTOLINK T6 devices immediately. If a patch is not currently provided by the vendor, implement strict network segmentation to isolate these devices from sensitive data environments until a secure configuration or update can be verified.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:50.765Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An improper access control vulnerability in TOTOLINK T6 allows unauthenticated attackers to modify mesh pairing configurations via a crafted POST request to the cstecgi.cgi endpoint.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated remote attackers to manipulate mesh network settings, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51721

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability involves an incorrect access control implementation within the setPairCfg function. It allows any unauthenticated attacker to send a malicious POST request to the cgi-bin/cstecgi.cgi endpoint to alter the device's mesh pairing state.

Business Impact

The ability for an unauthenticated attacker to modify mesh pairing configurations can lead to unauthorized access to the network, interception of traffic, or complete loss of network control. Given the CVSS score of 9.1, this vulnerability is classified as critical, as it bypasses authentication mechanisms and enables remote configuration changes that could facilitate further exploitation of the internal environment.

Remediation Plan

Immediate Action: Contact the vendor or consult the official TOTOLINK support portal to determine if a firmware update is available for the T6 model to patch this specific access control flaw.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and inspect device logs for unauthorized changes to mesh configuration settings.

Compensating Controls: Restrict management interface access to trusted internal IP addresses and employ a firewall to block external access to the web-based administrative endpoints of the device.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the lack of authentication required to execute this function makes it highly attractive for automated scanning and exploitation.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of authentication required to trigger the flaw, immediate action is required to secure affected devices. Administrators should verify the current firmware version and apply the latest vendor-supplied patches as soon as they are released to prevent unauthorized configuration changes.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:01:09.957Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to delete firewall filter rules via a crafted POST request.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to disable firewall protections, posing a severe risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-51720

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability resides in the delIpPortFilterRules function of the web management interface. It permits any unauthenticated attacker to remove firewall filter rules by sending a malicious POST request to the /cgi-bin/cstecgi.cgi endpoint.

Business Impact

Successful exploitation of this flaw allows an attacker to strip away firewall rules, effectively exposing the local network to unauthorized traffic and potential secondary attacks. Given the CVSS score of 9.1, this is classified as a critical risk that could lead to full compromise of internal network segments or sensitive data exfiltration by bypassing existing security perimeters.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal for firmware updates addressing this flaw, as the manufacturer has not yet released a specific patch version. If no update is available, restrict access to the web management interface to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at /cgi-bin/cstecgi.cgi and keep a close watch for unexpected changes to firewall configuration settings.

Compensating Controls: Deploy a network-level firewall or Web Application Firewall (WAF) to block unauthorized access to the device management interface from external or untrusted sources.

Exploitation Status

Public Exploit Available: Unknown (No confirmed public exploit in available data)

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its nature as an unauthenticated, automatable attack vector that directly targets perimeter security controls.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized modification of network security policies. Administrators should prioritize restricting access to the management interface and verify the device firmware status against the vendor website to identify if a fix has been issued.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:04:25.964Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control flaw in the TOTOLINK T6 router allows unauthenticated remote attackers to delete URL filtering rules by sending a malicious POST request to the cgi-bin interface.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to bypass security policies by removing configured URL filters.

Vulnerability Details

CVE-ID: CVE-2026-51719

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the delUrlFilterRules function, which fails to perform proper authentication checks. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to modify device security settings.

Business Impact

The ability for an unauthenticated attacker to remove URL filtering rules directly undermines the security posture of the network. This could allow users to access restricted, malicious, or unauthorized content that the organization intended to block, potentially leading to malware infection or data exfiltration. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to network integrity and policy enforcement.

Remediation Plan

Immediate Action: Review the official TOTOLINK support portal for available firmware updates addressing this flaw; if no patch exists, restrict access to the device management interface to trusted internal networks only.

Proactive Monitoring: Monitor device logs for anomalous POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement firewall rules to block external access to the device management interface and utilize network segmentation to isolate the router from public-facing exposure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 01, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and the ability to programmatically alter security configurations via the web interface.

Analyst Recommendation

Given the high impact of unauthorized security policy modification, organizations utilizing TOTOLINK T6 devices must prioritize securing the management interface immediately. Administrators should verify the current firmware version and apply any vendor-supplied security patches as soon as they are released to prevent potential exploitation.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:06.290Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control vulnerability in TOTOLINK T6 allows unauthenticated attackers to modify the device operating mode via a crafted POST request to the cgi-bin interface.

Executive Summary:
A critical access control flaw in TOTOLINK T6 routers allows unauthenticated remote attackers to modify device configurations, potentially leading to a full loss of network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51717

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the setOpModeCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter system operating modes.

Business Impact

This vulnerability carries a CVSS score of 9.1, indicating a critical risk to business operations. By unauthorized modification of device operating modes, an attacker could redirect traffic, intercept sensitive data, or render the router inoperable, leading to significant service disruption and potential compromise of internal network security.

Remediation Plan

Immediate Action: Check the official TOTOLINK support portal for firmware updates addressing this flaw and apply them to all affected T6 units immediately. If no patch is currently available for your specific build, restrict access to the web management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and review administrative logs for unauthorized changes to device configurations.

Compensating Controls: Implement firewall rules to block external access to the device management interface, ensuring it is only reachable from a secure, isolated management VLAN or via VPN.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the flaw is remotely exploitable without authentication, there is no confirmed evidence of weaponized code currently circulating in the wild.

Analyst Recommendation

Given the critical nature of this access control bypass and the potential for complete device manipulation, organizations must treat this vulnerability with high priority. Administrators should audit their device inventory for the affected firmware version and restrict management interface access until a confirmed vendor patch is applied.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:03.411Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control flaw in the TOTOLINK T6 router allows unauthenticated attackers to delete MAC filter rules by sending a malicious POST request to a specific CGI endpoint.

Executive Summary:
A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to bypass security configurations by deleting MAC filter rules.

Vulnerability Details

CVE-ID: CVE-2026-51715

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the delMacFilterRules function of the device firmware. An unauthenticated attacker can trigger this function by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint, resulting in the unauthorized removal of established MAC filtering rules.

Business Impact

The ability for an unauthenticated attacker to manipulate network security rules poses a significant threat to internal network integrity. By removing MAC filters, an attacker can bypass device-level access restrictions, potentially allowing unauthorized hardware to connect to the network or facilitating further lateral movement. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could lead to full compromise of network access control mechanisms.

Remediation Plan

Immediate Action: Verify if your device is running firmware version 4.1.5cu.748_B20211015 and consult the official TOTOLINK support portal for any available firmware updates to address this access control flaw.

Proactive Monitoring: Monitor device traffic logs for suspicious POST requests directed at /cgi-bin/cstecgi.cgi, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Restrict administrative access to the router management interface by disabling remote management and ensuring the device is not directly exposed to the public internet.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication and the ease of triggering the vulnerable function via standard web requests.

Analyst Recommendation

This vulnerability presents a severe risk to network security by exposing administrative controls to unauthenticated actors. Organizations utilizing the TOTOLINK T6 router must prioritize patching or, if a patch is unavailable, immediately isolate the device from external network exposure to prevent unauthorized configuration changes.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:22.422Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An improper access control flaw in TOTOLINK T6 allows unauthenticated attackers to manipulate WAN dial settings via crafted POST requests to the device.

Executive Summary:
A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to modify WAN dial configurations, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51713

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability resides in the setManualDialCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter dial state settings.

Business Impact

The vulnerability carries a CVSS score of 9.1, reflecting its critical nature and ease of exploitation. Successful manipulation of WAN dial settings can lead to unauthorized network redirection, denial of service for internet connectivity, or potential man-in-the-middle attacks, resulting in significant operational downtime and compromise of network traffic integrity.

Remediation Plan

Immediate Action: Organizations using the affected TOTOLINK T6 device should restrict access to the web management interface to trusted internal networks only. If a firmware update is released by the vendor, it should be applied immediately.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and investigate any unauthorized changes to WAN configuration settings.

Compensating Controls: Implement firewall rules to block external access to the device management interface, ensuring the interface is not exposed to the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated, remote nature, which allows for trivial exploitation of the device control plane.

Analyst Recommendation

Given the critical severity of this vulnerability and the potential for total loss of control over WAN dial configurations, administrators must prioritize securing the device management interface. Exposure of the administration panel to the public internet should be eliminated immediately to prevent unauthorized access while awaiting further vendor guidance or firmware patches.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:14.306Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.mdCVE-2026-51711","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to trigger a wireless pairing window via a crafted POST request.

Executive Summary:
A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to remotely initiate wireless pairing, potentially facilitating unauthorized network access.

Vulnerability Details

CVE-ID: CVE-2026-51711

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability resides in the setWiFiWpsStart function of the device firmware. It allows an unauthenticated attacker to send a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to activate the Wi-Fi Protected Setup (WPS) pairing process.

Business Impact

The ability for an unauthenticated remote attacker to force a wireless pairing state poses a significant risk to network security. By manipulating the WPS function, an attacker could potentially bypass authentication mechanisms to gain unauthorized access to the local wireless network. With a CVSS score of 9.1, this vulnerability is classified as critical, as it provides a low-complexity vector for compromising the confidentiality and integrity of network communications.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal for firmware updates or security patches for the T6 model. If no patch is available, disable the WPS functionality within the router settings to prevent exploitation.

Proactive Monitoring: Review device access logs for suspicious POST requests targeting the /cgi-bin/cstecgi.cgi endpoint. Monitor for unexpected activation of the WPS pairing status on the device.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only. Implement network segmentation to ensure that unauthorized wireless associations do not grant immediate access to sensitive internal resources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly accessible due to the lack of authentication requirements and the simple nature of the attack vector.

Analyst Recommendation

Given the critical severity of this vulnerability, administrators should prioritize securing affected TOTOLINK T6 devices immediately. If a vendor-provided firmware update is not currently available, disabling the WPS feature is the most effective method to neutralize this attack vector. Continuous monitoring of network traffic for unauthorized pairing attempts is recommended until a permanent patch can be applied.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:37.924Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
TOTOLINK T6 routers contain an incorrect access control vulnerability in the setParentalRules function, allowing unauthenticated attackers to modify parental controls via crafted POST requests.

Executive Summary:
An unauthenticated access control vulnerability in TOTOLINK T6 routers allows remote attackers to manipulate parental control settings, posing a significant risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-51710

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability involves incorrect access control within the setParentalRules function. Unauthenticated attackers can trigger this flaw by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Business Impact

The ability for an unauthenticated attacker to alter parental control configurations allows for the bypass of established internet safety and usage policies. Given the CVSS score of 9.1, this represents a critical risk, as it facilitates unauthorized control over network traffic management and potentially exposes connected users to restricted or harmful content.

Remediation Plan

Immediate Action: Check the official TOTOLINK support portal for firmware updates addressing this flaw and apply them immediately if available.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /cgi-bin/cstecgi.cgi interface, particularly those originating from untrusted external sources.

Compensating Controls: Restrict access to the router administrative interface to trusted internal IP addresses only, and ensure the device is not exposed directly to the public internet via WAN-side management.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly accessible due to the lack of required authentication, no weaponized exploit code has been confirmed.

Analyst Recommendation

Due to the critical severity of this vulnerability, administrators should prioritize securing affected TOTOLINK T6 devices by isolating them from external network access. Verify firmware versions against the manufacturer guidance and apply patches as soon as they are released to prevent unauthorized manipulation of router security settings.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:19.416Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in TOTOLINK T6 allows unauthenticated attackers to reconfigure Wi-Fi settings via a crafted POST request.

Executive Summary:
A critical authentication bypass vulnerability in the TOTOLINK T6 router permits unauthenticated attackers to modify sensitive Wi-Fi configurations, posing a high risk of network compromise.

Vulnerability Details

CVE-ID: CVE-2026-51709

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists within the setWiFiBasicCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter primary wireless network settings.

Business Impact

The ability for an unauthenticated attacker to reconfigure Wi-Fi settings allows for unauthorized network access, potential man-in-the-middle attacks, and total control over the wireless gateway. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could lead to the complete compromise of data traversing the local network and unauthorized access to internal resources.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal to determine if a firmware update addressing this specific flaw has been released for the T6 model.

Proactive Monitoring: Review device logs for unusual POST requests directed toward /cgi-bin/cstecgi.cgi and monitor for unexpected changes in Wi-Fi configuration settings.

Compensating Controls: If a patch is unavailable, restrict access to the device management interface to trusted internal IP addresses only and disable remote administration features until the vulnerability is addressed.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of Sep 01, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is not currently confirmed, the design of the flaw allows for remote, unauthenticated exploitation, which makes it an attractive target for automated scanning.

Analyst Recommendation

This vulnerability is highly critical due to the lack of required authentication for administrative actions. Organizations using the TOTOLINK T6 must prioritize the identification of a vendor-supplied firmware update. Until a patch is applied, ensure that management interfaces are not exposed to the public internet to mitigate the risk of unauthorized configuration changes.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:01:11.582Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An improper access control flaw in the TOTOLINK T6 router allows unauthenticated remote attackers to modify WPS settings via a crafted POST request to the administrative CGI interface.

Executive Summary:
A critical security vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to modify device configurations, posing a significant risk to network security.

Vulnerability Details

CVE-ID: CVE-2026-51708

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The device fails to perform adequate authorization checks within the setWiFiWpsCfg function. An unauthenticated attacker can exploit this by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter wireless configuration settings.

Business Impact

Successful exploitation allows unauthorized modification of router settings, which can lead to the disabling of security features or the establishment of unauthorized network access. With a CVSS score of 9.8, this vulnerability is classified as critical due to the lack of required authentication and the potential for full configuration compromise. This exposure could facilitate further network infiltration or service disruption, resulting in severe operational and security consequences.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal to determine if a firmware update addressing this specific configuration vulnerability is available for the T6 model.

Proactive Monitoring: Review device access logs for suspicious POST requests targeting /cgi-bin/cstecgi.cgi, particularly from external or untrusted network interfaces.

Compensating Controls: Ensure the router management interface is not exposed to the public internet and restrict access to administrative functions to a dedicated, secure management VLAN or local network segment.

Exploitation Status

Public Exploit Available: No (As of Aug 30, 2026, there is no confirmed public exploit or weaponized code available).

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible as it does not require authentication or user interaction to trigger.

Analyst Recommendation

Given the critical severity of this vulnerability and the ease with which an unauthenticated attacker can interact with the affected function, immediate action is required. Organizations utilizing the TOTOLINK T6 should prioritize restricting network access to the device management interface until a verified firmware patch is applied to remediate the underlying access control failure.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:53.846Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control flaw in the TOTOLINK T6 router allows unauthenticated attackers to modify wireless configuration settings via a crafted POST request.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers enables unauthenticated attackers to manipulate wireless settings and potentially compromise network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51700

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The vulnerability exists in the setWiFiAdvancedCfg function, which fails to perform necessary authentication checks. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to alter wireless behavior.

Business Impact

Successful exploitation of this vulnerability permits unauthorized modification of critical network settings, which can lead to significant service disruption or the degradation of wireless security protocols. Given the CVSS score of 9.1, this flaw is categorized as critical, posing a high risk to network availability and data confidentiality for environments relying on these devices.

Remediation Plan

Immediate Action: Review the vendor advisory at the official TOTOLINK website for available firmware updates and apply them as soon as they are released for the T6 model.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/cstecgi.cgi and investigate any unauthorized changes to wireless configuration logs.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of the router, ensuring it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub repositories.

Analyst Notes: As of August 31, 2026, there is no confirmed active exploitation in the wild, though the availability of public technical write-ups and proof-of-concept code necessitates immediate defensive action. The vulnerability is inherently exploitable due to the lack of authentication mechanisms on the target function.

Analyst Recommendation

Due to the critical nature of this vulnerability and the ease with which an unauthenticated attacker can manipulate router settings, immediate action is required. Organizations using the TOTOLINK T6 device should prioritize isolating the management interface from untrusted networks and applying the latest firmware updates provided by the vendor to fully mitigate this risk.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-02T14:02:45.813Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to modify browsing policies via crafted POST requests to the cstecgi.cgi endpoint.

Executive Summary:
A critical access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to manipulate network filtering rules, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51698

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The device fails to perform proper authentication checks within the setUrlFilterRules function, which is reachable via the cstecgi.cgi interface. Unauthenticated remote attackers can exploit this by sending a specifically crafted POST request to alter the device browsing policies.

Business Impact

The vulnerability carries a CVSS score of 9.1, indicating a critical severity level due to the ease of remote exploitation without authentication. Successful exploitation allows unauthorized modification of security policies, which could be leveraged to bypass content filtering, redirect traffic, or facilitate man-in-the-middle attacks against connected clients. This poses a significant risk to organizational data security and network trust.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal for firmware updates addressing this vulnerability, as no public patch version is currently confirmed. If an update is unavailable, restrict management access to the device to trusted internal networks only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the cstecgi.cgi endpoint, particularly those originating from untrusted or external IP addresses.

Compensating Controls: Implement strict network perimeter controls, such as disabling remote management features on the router and utilizing a firewall to block unauthorized access to the web management interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it resides in a core administrative function that is reachable without any session validation.

Analyst Recommendation

Given the critical nature of this access control failure and the potential for complete manipulation of network browsing policies, administrators must prioritize restricting access to the router management interface immediately. Until the vendor provides a validated firmware patch, the device should be considered compromised if reachable from an untrusted network.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:01:17.559Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An access control vulnerability in TOTOLINK T6 allows unauthenticated attackers to enable WAN-side administration via a crafted POST request to the cgi-bin interface.

Executive Summary:
A critical access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to expose administrative interfaces to the public internet, creating a high risk of unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-51681

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This flaw exists within the setRemoteCfg function, where insufficient access control permits an unauthenticated attacker to modify device configuration by sending a specifically crafted POST request to the /cgi-bin/cstecgi.cgi endpoint.

Business Impact

The ability for an unauthenticated remote attacker to enable WAN-side administration creates a severe security risk, as it bypasses intended network segmentation and exposes the management interface to the public internet. This provides a direct vector for further exploitation, potential credential harvesting, or full device takeover, which justifies the critical CVSS score of 9.1. Such exposure can lead to significant data compromise and total loss of device integrity within the corporate or home network.

Remediation Plan

Immediate Action: Administrators should immediately restrict access to the web management interface to trusted local IP addresses only and disable WAN-side management access within the device settings.

Proactive Monitoring: Monitor firewall logs and web server access logs for any POST requests directed to /cgi-bin/cstecgi.cgi, particularly those originating from external or untrusted IP addresses.

Compensating Controls: Implement a strict perimeter firewall policy that blocks all inbound traffic to the router management ports (typically 80 or 443) from the WAN interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 31, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is considered highly exploitable due to the lack of required authentication for the vulnerable function.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for complete exposure of administrative functions, organizations must treat this as a high-priority risk. Immediately audit existing TOTOLINK T6 deployments to ensure remote management features are disabled and verify that the device is not reachable from the internet. Continue to monitor vendor support channels for the release of a firmware update that addresses the underlying access control deficiency.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-01T09:01:47.320Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---