CVE-2026-1548: Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection
A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1548?
CVE-2026-1548 has been classified with a high severity due to its potential for command injection.
How do I fix CVE-2026-1548?
To fix CVE-2026-1548, users should upgrade their Totolink A7000R firmware to the latest version that addresses this vulnerability.
What type of attack can be performed using CVE-2026-1548?
CVE-2026-1548 allows an attacker to execute arbitrary commands on the device via the affected CloudACMunualUpdateUserdata function.
Which devices are affected by CVE-2026-1548?
CVE-2026-1548 specifically affects the Totolink A7000R router with version 4.1cu.4154.
Is CVE-2026-1548 easy to exploit?
Yes, CVE-2026-1548 can be easily exploited if the device is exposed to untrusted networks.