Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-1548 Unauthenticated Remote Command Injection in Totolink A7000R Router Firmware https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1548
Post summary
The post announces CVE-2026‑1548 as an unauthenticated remote command injection in a Totolink router firmware, without providing PoC, exploit, patch details, or evidence of active exploitation.
CVE-2026-1548 A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the ar… https://www.cve.org/CVERecord?id=CVE-2026-1548
Post summary
A flaw has been identified in the CloudACMunualUpdateUserdata function of Totolink A7000R, with no information on exploitability, mitigation, or PoC provided.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | totolink | a7000r | - | - | - |
| OS | totolink | a7000r_firmware | 4.1cu.4154 | - | - |