A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2026-5692 is a medium severity OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setGameSpeedCfg function within /cgi-bin/cstecgi.cgi, where manipulation of the 'enable' argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without authentication. Although an exploit has been publicly disclosed, there is no official patch or remediation guidance available at this time.
CVE-2026-5691 is a medium-severity OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. It affects the setFirewallType function in the /cgi-bin/cstecgi.cgi file, where manipulation of the firewallType argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-5690 is a medium severity OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setRemoteCfg function of the /cgi-bin/cstecgi.cgi file, where manipulation of the 'enable' argument can lead to remote OS command injection. The vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-5689 is a medium severity OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setNtpCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the tz argument can lead to remote OS command injection. This vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5679 is a medium severity OS command injection vulnerability in the Totolink A3300R router firmware version 17.0.0cu.557_B20221024. The flaw exists in the vsetTr069Cfg function within /cgi-bin/cstecgi.cgi, where manipulation of the stun_pass argument can lead to command injection. This vulnerability has been publicly disclosed but no known exploits in the wild have been reported. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-5678 is an OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the setScheduleCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the 'mode' argument can lead to remote command execution. This vulnerability allows an unauthenticated attacker to execute arbitrary OS commands remotely. The exploit code has been publicly disclosed. The CVSS 4.0 score is 6.9, indicating a medium severity level.
CVE-2026-5677 is a medium severity OS command injection vulnerability in the Totolink A7100RU router firmware version 7.4cu.2313_b20191024. The flaw exists in the CsteSystem function of the /cgi-bin/cstecgi.cgi file, where manipulation of the resetFlags argument allows remote attackers to inject operating system commands. The vulnerability can be exploited without authentication and user interaction. Although a public exploit is available, there is no confirmed patch or official remediation from the vendor at this time.
CVE-2026-5676 is a medium severity vulnerability in the Totolink A8000R router firmware version 5.9c.681_B20180413. It involves missing authentication in the setLanguageCfg function within /cgi-bin/cstecgi.cgi, allowing remote attackers to manipulate the langType argument without authentication. The vulnerability can be exploited remotely, and a public exploit exists. No official patch or remediation guidance is currently available from the vendor.
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5176 is a command injection vulnerability in the Totolink A3300R router firmware version 17.0.0cu.557_b20221024. The flaw exists in the setSyslogCfg function within the /cgi-bin/cstecgi.cgi file. An attacker can remotely manipulate input arguments to execute arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
CVE-2026-5105 is a medium severity command injection vulnerability in the Totolink A3300R router firmware version 17.0.0cu.557_b20221024. The flaw exists in the setVpnPassCfg function within the /cgi-bin/cstecgi.cgi component, where manipulation of the pptpPassThru argument allows remote attackers to execute arbitrary commands. The vulnerability can be exploited remotely without user interaction. Although the exploit code is publicly available, there is no confirmed evidence of exploitation in the wild. No official patch or remediation guidance has been provided yet.
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStaticRoute of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ip leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVE-2026-5103 is a command injection vulnerability in the Totolink A3300R router firmware version 17.0.0cu.557_b20221024. The issue exists in the setUPnPCfg function of the /cgi-bin/cstecgi.cgi file, where manipulation of the 'enable' argument allows remote attackers to execute arbitrary commands. The vulnerability has a medium severity with a CVSS score of 5.3. Although an exploit is publicly available, there are no confirmed reports of exploitation in the wild. No patch or official remediation information is currently provided.
CVE-2026-5102 is a medium severity vulnerability in the Totolink A3300R router firmware version 17.0.0cu.557_b20221024. It involves a command injection flaw in the setSmartQosCfg function within the /cgi-bin/cstecgi.cgi component. The vulnerability arises from improper handling of the qos_up_bw argument, allowing remote attackers to execute arbitrary commands. Although an exploit has been publicly released, there are no known exploits observed in the wild yet. No official patch or remediation guidance is currently available from the vendor.
A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched remotely. The exploit is now public and may be used.