CVE-2026-1601

MEDIUM

Totolink A7000r Firmware - Command Injection

Title source: rule

Description

A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

References (6)

[Exploit, Third Party Advisory] https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/03_RCE_setUploadUserData_RCE.md

View Exploit ZIP pw:eip

[Exploit] https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/03_RCE_setUploadUserData_RCE.md#poc

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.343373

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.343373

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.740760

[Product] https://www.totolink.net/

Scores

CVSS v3 6.3

EPSS 0.0833

EPSS Percentile 92.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-74 CWE-77

Status published

Affected Products (1)

totolink/a7000r_firmware

Timeline

Published Jan 29, 2026

Tracked Since Feb 18, 2026