Threat database

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

CVE-2026-7037 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. It affects the setVpnPassCfg function within the /cgi-bin/cstecgi.cgi CGI handler. An attacker can remotely manipulate the pptpPassThru argument to execute arbitrary operating system commands. The vulnerability has a high CVSS score of 9.3, indicating severe impact if exploited. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-6157 is a high-severity buffer overflow vulnerability in the Totolink A800R router firmware version 4.1.2cu.5137_B20200730. It affects the function setAppEasyWizardConfig within the /lib/cste_modules/app.so library. The vulnerability arises from improper handling of the apcliSsid argument, allowing remote attackers to trigger a buffer overflow. Exploit code for this vulnerability is publicly available. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-6156 is a critical OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. It affects the setIpQosRules function within the /cgi-bin/cstecgi.cgi CGI handler component. The vulnerability arises from improper handling of the 'Comment' argument, allowing remote attackers to execute arbitrary OS commands without authentication. Although the exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-6154 is a critical OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setWizardCfg function within the /cgi-bin/cstecgi.cgi CGI handler, where manipulation of the 'wizard' argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without authentication and has a high CVSS 4.0 score of 9.3. Although an exploit has been publicly released, there is no confirmed patch or official remediation available at this time.

CVE-2026-6140 is a critical OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. It affects the UploadFirmwareFile function within the /cgi-bin/cstecgi.cgi CGI handler component. An attacker can remotely manipulate the FileName argument to execute arbitrary OS commands. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. Although the exploit details are public, no official patch or remediation guidance has been provided by the vendor as of the publication date.

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-6138 is a critical OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi CGI handler, where improper handling of the mac argument allows remote attackers to execute arbitrary OS commands. The vulnerability can be exploited without authentication or user interaction. Although an exploit has been published, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-6132 is a critical OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setLedCfg function of the /cgi-bin/cstecgi.cgi CGI handler, where manipulation of the 'enable' argument allows remote attackers to execute arbitrary OS commands. This vulnerability can be exploited remotely without authentication. Although the exploit has been publicly disclosed, there is no confirmed patch or official remediation available at this time.

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument ip leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setAppCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enable can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setNetworkCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument proto results in os command injection. The attack may be initiated remotely. The exploit is now public and may be used.