Description
A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-01-29
Score: 5.3 Medium
EPSS: 1.4% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the setUpgradeFW function within the cstecgi.cgi file of the Totolink A7000R firmware. By manipulating the FileName argument, an attacker can inject arbitrary shell commands, leading to remote execution of commands on the router and compromising confidentiality, integrity, and availability. The weakness maps to command injection flaws and can be triggered from outside the device via HTTP requests.

Affected Systems

Affected devices are Totolink A7000R routers running firmware version 4.1cu.4154. The vulnerability is present in the /cgi-bin/cstecgi.cgi component handling firmware upgrades. No other versions or products are listed; users of this exact model and firmware should verify the build before addressing the issue.

Risk and Exploitability

The CVSS base score is 5.3, indicating a medium-level severity. The EPSS probability of exploitation is 2 %, suggesting that while the vulnerability is not currently widely abused, it remains exploitable. The vulnerability is not yet identified in the CISA KEV catalog. Attackers could trigger it by remotely sending a crafted HTTP POST request to the setUpgradeFW endpoint, so the attack vector is network remote through the web interface. Given the potential for remote code execution, the risk to a connected network is significant.

Generated by OpenCVE AI on April 18, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router to the latest firmware that addresses the setUpgradeFW command injection flaw.
  • Restrict or disable remote access to the router’s management interface, limiting traffic to trusted IPs or turning off public management features.
  • If possible, configure the router to block or sanitize the FileName parameter in setUpgradeFW, restricting its use to trusted local sources or disabling the feature entirely.

Generated by OpenCVE AI on April 18, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:totolink:a7000r_firmware:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink a7000r Firmware
CPEs cpe:2.3:h:totolink:a7000r:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:a7000r_firmware:4.1cu.4154:*:*:*:*:*:*:*
Vendors & Products Totolink a7000r Firmware

Fri, 30 Jan 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink a7000r
Vendors & Products Totolink
Totolink a7000r

Thu, 29 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Jan 2026 20:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Title Totolink A7000R cstecgi.cgi setUpgradeFW command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink A7000r A7000r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:07:06.095Z

Reserved: 2026-01-29T14:39:06.213Z

Link: CVE-2026-1623

cve-icon Vulnrichment

Updated: 2026-01-29T21:19:19.688Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-29T21:15:53.427

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T01:30:16Z

Weaknesses