CVE-2026-5020

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Mar 29, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-502007.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Man CVE-2026-502016.5Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Man CVE-2026-502025.9Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Sec CVE-2026-502039.1A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote CVE-2026-502058.2System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.CVE-2026-502066.8Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.CVE-2026-502077.8The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disabl CVE-2026-502089.4High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-CVE-2026-502097.8Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting administ CVE-2026-50218.8A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the compon CVE-2026-502107.5The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and kno CVE-2026-502119.8Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileg