CVE-2026-5020

Name of the Vulnerable Software and Affected Versions Totolink A3600R version 4.1.2cu.5182 B20201102

Description A command injection issue exists in the setNoticeCfg function within the /cgi-bin/cstecgi.cgi file of the Parameter Handler component. Manipulation of the NoticeUrl argument can allow remote attackers to execute arbitrary commands. The exploit for this issue is publicly available and may be used to compromise the system.

Recommendations Update the firmware to mitigate the risks. As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file.