PT-2026-28734 · Totolink · Totolink A3600R

Wxhwxhwxh_Mie · Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-5020

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Totolink A3600R version 4.1.2cu.5182 B20201102

Description A command injection issue exists in the setNoticeCfg function within the /cgi-bin/cstecgi.cgi file of the Parameter Handler component. Manipulation of the NoticeUrl argument can allow remote attackers to execute arbitrary commands. The exploit for this issue is publicly available and may be used to compromise the system.

Recommendations Update the firmware to mitigate the risks. As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5020

Affected Products

Totolink A3600R

References · 11

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK_A3600R_setNoticeCfg-32253a41781f80c197eaf8e7558c5ed1?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5020 · Security Note
• https://vuldb.com/vuln/353905 · Note
• https://vuldb.com/submit/779536 · Note
• https://twitter.com/NewsNerdie/status/2038315897555734596 · Twitter Post
• https://twitter.com/cybrsecpath/status/2038090855396126963 · Twitter Post
• https://vuldb.com/vuln/353905/cti · Note
• https://twitter.com/CVEnew/status/2038135154326245781 · Twitter Post
• https://twitter.com/CVEarity/status/2038260938466537685 · Twitter Post
• https://totolink.net · Note
• https://twitter.com/cyberbivash/status/2038080136919007595 · Twitter Post