CVE Intelligence
Analysis AI-assisted

CVE-2026-5020: Totolink A3600R setNoticeCfg command injection

VulDB reports a remote command injection in the setNoticeCfg function of the Totolink A3600R, triggered through the NoticeUrl argument. NVD rates it critical with a CVSS base score of 9.8. A public exploit reference exists, but the CVE is not listed in CISA KEV and the record shows no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

VulDB reports a command injection flaw in the setNoticeCfg function of the /cgi-bin/cstecgi.cgi handler on the Totolink A3600R, firmware 4.1.2cu.5182_B20201102. The NoticeUrl argument is the manipulated input. NVD assigns a CVSS base score of 9.8 (critical). See NVD and VulDB.

Impact

  • The record describes command injection that may be launched remotely.
  • The NVD assessment indicates a network attack vector, no privileges required and no user interaction, with high confidentiality, integrity and availability impact.
  • The exact consequences depend on the device configuration and are not detailed in the sources.

Affected products and versions

  • Totolink A3600R, version 4.1.2cu.5182_B20201102.
  • Totolink A3600r Firmware, version 4.1.2cu.5182_b20201102.
  • No other versions appear in the sources consulted.

Exploitation status

This CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted. The VulDB description states the exploit is public and may be used, and a third-party reference tagged as an exploit is listed. The SSVC data lists exploitation as poc and automatable as no.

Remediation and mitigation

  • The record lists no fixed version. Check firmware updates from the vendor at Totolink.
  • Restrict access to the device management interface and do not expose it to the internet.
  • Review and limit notification or URL-related settings where possible.
  • Plan replacement of the device if no supported update becomes available.

Detection guidance

  • Monitor management interface traffic addressed to cstecgi.cgi for unexpected requests from untrusted sources.
  • Review device configuration for unexpected changes to notification-related parameters.
  • Watch for unusual outbound connections originating from the router.

Limitations of the available information

  • The record does not list a fixed version or a vendor patch.
  • The record gives no detail on the exact handling of the input, and this analysis does not describe it.
  • The EPSS probability is 0.03714 with a percentile of 0.89723.
  • No detailed vendor advisory is included in the record.

Frequently asked questions

Is CVE-2026-5020 being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The VulDB entry says a public exploit exists and may be used.

Which Totolink A3600R versions are affected?

The record lists the Totolink A3600R and its firmware at version 4.1.2cu.5182_B20201102, with the lowercase firmware spelling 4.1.2cu.5182_b20201102 also listed. No other versions appear in the sources.

Is there a fix?

The record lists no fixed version. Check the vendor for firmware updates and restrict access to the management interface until a fix is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.