CVE-2026-1547: Totolink A7000R cstecgi.cgi setUnloadUserData command injection
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pluginname results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1547?
CVE-2026-1547 is considered a high severity vulnerability due to the potential for command injection in the Totolink A7000R router.
How do I fix CVE-2026-1547?
To fix CVE-2026-1547, update the firmware of your Totolink A7000R router to the latest version provided by the manufacturer.
What does CVE-2026-1547 affect?
CVE-2026-1547 affects the Totolink A7000R router model specifically in its cgi-bin/cstecgi.cgi file and the setUnloadUserData function.
Can CVE-2026-1547 be exploited remotely?
Yes, CVE-2026-1547 can be exploited remotely if an attacker has access to the affected function on the Totolink A7000R router.
What is the potential impact of CVE-2026-1547?
The potential impact of CVE-2026-1547 includes unauthorized command execution on the vulnerable Totolink A7000R router.