Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-1547 Unauthenticated Command Injection in Totolink A7000R Router Firmware https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1547
Post summary
The CVE-2026-1547 disclosure announces an unauthenticated command injection flaw in Totolink A7000R router firmware, with no PoC, exploit, patch, or active exploitation details provided.
CVE-2026-1547 A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argume… https://www.cve.org/CVERecord?id=CVE-2026-1547
Post summary
A vulnerability CVE-2026-1547 was detected in the Totolink A7000R router, affecting the setUnloadUserData function in /cgi-bin/cstecgi.cgi. The post provides limited technical detail, with no PoC, exploit, patch, or evidence of active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | totolink | a7000r | - | - | - |
| OS | totolink | a7000r_firmware | 4.1cu.4154 | - | - |