CVE-2026-1547 in A7000R

Résumé

par MITRE • 29/01/2026

A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsable: VulDB
• Divulgation: 29/01/2026
• Modérer: accepté
• Entrée: VDB-343231
• CPE: prêt
• CWE: CWE-77 (confirmé)
• Exploitation: Télécharger
• CVSS: 9.8 (NVD)
• EPSS: 0.02769
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-1547
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-1547
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-1547/