CVE-2026-1623

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jan 29, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-162309.8The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete CVE-2026-162318.1hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async help CVE-2026-162329.8An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an CVE-2026-162337.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-162347.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-162359.8Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, wh CVE-2026-162368.8The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to CVE-2026-162388.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user ru CVE-2026-162398.8Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the data CVE-2026-16248.8A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLt CVE-2026-162413.8Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client v CVE-2026-162429.4A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --c