CNNVD-202601-4637 Information

Jan 28, 2026 cve

CNNVD ID

CNNVD-202601-4637

CVE-2026-1547

CNNVD Published: 2026-01-28

Description (Chinese)

TOTOLINK A7000R是中国吉翁电子（TOTOLINK）公司的一款无线路由器。 TOTOLINK A7000R 4.1cu.4154版本存在命令注入漏洞，该漏洞源于对文件/cgi-bin/cstecgi.cgi中setUnloadUserData函数的参数plugin_name的错误操作，可能导致命令注入攻击。

Description (English)

TOTOLINK A7000R is a wireless router of the Chinese company TOTOLINK. TOTOLINK A7000R 4.1-cu.4154 has a command-injecting loophole, which arises from the error of plugin name in the parameter setUnloadUserData function in document/cgi-bin/cstecgi.cgi, which may result in an order-injecting attack.

Hazard Level

High

Vulnerability Type

命令注入

Affected Vendor

吉翁电子

Published

2026-01-28

Last Modified

2026-02-24

References

https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/01_RCE_setUnloadUserData_RCE.md https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/01_RCE_setUnloadUserData_RCE.md#poc https://vuldb.com/?ctiid.343231 https://vuldb.com/?id.343231 https://vuldb.com/?submit.739713 https://www.totolink.net/

Share on: