PT-2026-30700 · Totolink · A8000R

Skeet · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5676

Mitre

CVSS v3.1

7.3

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in Totolink A8000R 5.9c.681 B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-5676

Affected Products

A8000R

References · 6

• 🔥 https://github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5676 · Security Note
• https://vuldb.com/vuln/355503/cti · Note
• https://vuldb.com/vuln/355503 · Note
• https://vuldb.com/submit/792433 · Note
• https://totolink.net · Note