CVE-2026-1623

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Totolink	A7000R	4.1cu.4154

References

https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.mdExploit, Third Party Advisory
https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#pocExploit
https://vuldb.com/?ctiid.343382Permissions Required, VDB Entry
https://vuldb.com/?id.343382Third Party Advisory, VDB Entry
https://vuldb.com/?submit.740767Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Timeline

Published: Jan 29, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-162309.8The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete CVE-2026-162318.1hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async help CVE-2026-162329.8An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an CVE-2026-162337.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-162347.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-162359.8Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, wh CVE-2026-162368.8The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to CVE-2026-162375.4Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on t CVE-2026-162388.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user ru CVE-2026-162398.8Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the data CVE-2026-16248.8A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLt CVE-2026-162403.7Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve dis