CVE-2026-5020

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Totolink	A3600R	4.1.2cu.5182_B20201102

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK_A3600R_setNoticeCfg-32253a41781f80c197eaf8e7558c5ed1?source=copy_linkExploit, Third Party Advisory
https://vuldb.com/submit/779536Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353905Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353905/ctiPermissions Required, VDB Entry
https://www.totolink.net/Product

Timeline

Published: Mar 29, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-502007.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Man CVE-2026-502016.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Man CVE-2026-502025.9Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Sec CVE-2026-502039.1A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote CVE-2026-502046.5Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because the secrets masker ma CVE-2026-502058.2System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.CVE-2026-502066.8Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.CVE-2026-502077.8The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disabl CVE-2026-502089.4High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-CVE-2026-502097.8Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administ CVE-2026-50218.8A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the compon CVE-2026-502107.5The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and kno