← back
CVE-2026-5676

Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication

CVSS 6.9 MEDIUMEPSS 0.4%CWE-287CWE-306
A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Totolink · A8000R
public PoCs found — 1
cve_referencegithub.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.mdunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.mdhttps://vuldb.com/submit/792433https://vuldb.com/vuln/355503https://vuldb.com/vuln/355503/ctihttps://www.totolink.net/