CVE Intelligence
Analysis AI-assisted

CVE-2026-1547: Totolink A7000R Firmware Command Injection in cstecgi.cgi

CVE-2026-1547 is a command injection weakness (CWE-77) reported in Totolink A7000R firmware version 4.1cu.4154, in the setUnloadUserData function of /cgi-bin/cstecgi.cgi. NVD lists a CVSS 3.1 base score of 9.8 (critical), and the record states that remote attack is possible and that a public exploit exists. No fixed version is listed in the sources consulted, and the CVE is not in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-1547 describes a command injection vulnerability (CWE-77) in the Totolink A7000R firmware, version 4.1cu.4154. According to the record, the flaw is in the setUnloadUserData function of the /cgi-bin/cstecgi.cgi handler, where manipulation of the plugin_name argument leads to injection of commands. The record was published on 2026-01-28 and its status is Analyzed. The primary public descriptions come from VulDB and the NVD entry.

Impact

Command injection can allow an attacker to run operating system commands on the affected device, with the privileges of the vulnerable service. The NVD base score is 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack vector, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Other CNA-provided scores in the record are lower, so the severity depends on the scoring source used.

Affected products and versions

  • Totolink A7000R firmware, version 4.1cu.4154, as listed in the record.
  • The record does not state whether other versions or hardware revisions are affected. The range of affected versions is unknown.

Exploitation status

  • The record states that the exploit is public and may be used.
  • The CVE is not listed in the CISA KEV catalog in the record (listed: false), so no confirmed active exploitation is reported in the sources consulted.
  • A public exploit reference is listed in the record on GitHub. This article does not describe its content.

Remediation and mitigation

  • The record lists no fixed version. Check the Totolink website and the vendor support channels for firmware updates for the A7000R.
  • Reduce exposure: do not expose the device administration or CGI interfaces to the internet, and restrict access to trusted management networks.
  • Place IoT and router devices in segmented networks so that a compromised device has limited reach.
  • Review whether any affected device is internet-facing and prioritize it for review.
  • Replace or retire the device if no vendor fix is available and the risk cannot be contained.

Detection guidance

  • Review web server and CGI access logs for unexpected requests to /cgi-bin/cstecgi.cgi, especially from unknown sources.
  • Monitor the device for unexpected outbound connections, new processes or configuration changes.
  • Track firmware versions across the inventory to identify any A7000R units running 4.1cu.4154.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory and no confirmed list of affected versions.
  • The EPSS and SSVC fields are empty, so exploitation likelihood is not quantified in the record.
  • The scores differ between providers: NVD provides 9.8 under CVSS 3.1, while the CNA (cna@vuldb.com) provides several other scores under CVSS 4.0, 3.1 and 2.0.
  • Details of the vendor response are unknown.

Frequently asked questions

What is CVE-2026-1547?

It is a command injection weakness (CWE-77) reported in Totolink A7000R firmware version 4.1cu.4154, in the setUnloadUserData function of /cgi-bin/cstecgi.cgi.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit exists.

Is there a fixed version?

The record lists no fixed version. This does not confirm that no fix exists; check the vendor website and support channels.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.