cve-2026-1623

{
  "cve": "CVE-2026-1623",
  "enrichment": {
    "analysis": {
      "en": {
        "generated_at": "2026-04-18T01:21:37.155240+00:00",
        "value": {
          "mitigation_remediation": [
            "Upgrade the router to the latest firmware that addresses the setUpgradeFW command injection flaw.",
            "Restrict or disable remote access to the router’s management interface, limiting traffic to trusted IPs or turning off public management features.",
            "If possible, configure the router to block or sanitize the FileName parameter in setUpgradeFW, restricting its use to trusted local sources or disabling the feature entirely."
          ],
          "summary": {
            "action": "Immediate Patch",
            "impact": "Remote Code Execution"
          },
          "threat_synthesis": {
            "affected_systems": "Affected devices are Totolink A7000R routers running firmware version 4.1cu.4154. The vulnerability is present in the /cgi-bin/cstecgi.cgi component handling firmware upgrades. No other versions or products are listed; users of this exact model and firmware should verify the build before addressing the issue.",
            "description_and_impact": "The vulnerability resides in the setUpgradeFW function within the cstecgi.cgi file of the Totolink A7000R firmware. By manipulating the FileName argument, an attacker can inject arbitrary shell commands, leading to remote execution of commands on the router and compromising confidentiality, integrity, and availability. The weakness maps to command injection flaws and can be triggered from outside the device via HTTP requests.",
            "risk_and_exploitability": "The CVSS base score is 5.3, indicating a medium-level severity. The EPSS probability of exploitation is 2 %, suggesting that while the vulnerability is not currently widely abused, it remains exploitable. The vulnerability is not yet identified in the CISA KEV catalog. Attackers could trigger it by remotely sending a crafted HTTP POST request to the setUpgradeFW endpoint, so the attack vector is network remote through the web interface. Given the potential for remote code execution, the risk to a connected network is significant."
          }
        }
      }
    },
    "created": "2026-01-30T08:42:26.131170+00:00",
    "updated": "2026-04-18T01:30:16.036559+00:00",
    "vendors": [
      "totolink",
      "totolink$PRODUCT$a7000r"
    ]
  },
  "epss": {
    "score": 0.02267
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:o:totolink:a7000r_firmware:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-01-29T20:32:08.374000+00:00",
    "description": "A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
    "metrics": {
      "cvssV2_0": {
        "score": 6.5,
        "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
      },
      "cvssV3_0": {
        "score": 6.3,
        "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
      },
      "cvssV3_1": {
        "score": 6.3,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
      },
      "cvssV4_0": {
        "score": 5.3,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
      }
    },
    "mitre_repo_path": "cves/2026/1xxx/CVE-2026-1623.json",
    "references": [
      "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md",
      "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#poc",
      "https://vuldb.com/?ctiid.343382",
      "https://vuldb.com/?id.343382",
      "https://vuldb.com/?submit.740767",
      "https://www.totolink.net/"
    ],
    "title": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection",
    "updated": "2026-02-23T09:07:06.095000+00:00",
    "vendors": [
      "totolink",
      "totolink$PRODUCT$a7000r_firmware"
    ],
    "weaknesses": [
      "CWE-74",
      "CWE-77"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:h:totolink:a7000r:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:totolink:a7000r_firmware:4.1cu.4154:*:*:*:*:*:*:*"
    ],
    "created": "2026-01-29T21:15:53.427000+00:00",
    "description": "A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
    "metrics": {
      "cvssV2_0": {
        "score": 6.5,
        "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
      },
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.3,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
      },
      "cvssV4_0": {
        "score": 2.1,
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
      }
    },
    "nvd_repo_path": "2026/CVE-2026-1623.json",
    "references": [
      "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md",
      "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#poc",
      "https://vuldb.com/?ctiid.343382",
      "https://vuldb.com/?id.343382",
      "https://vuldb.com/?submit.740767",
      "https://www.totolink.net/"
    ],
    "title": null,
    "updated": "2026-06-17T10:16:12.407000+00:00",
    "vendors": [
      "totolink",
      "totolink$PRODUCT$a7000r",
      "totolink$PRODUCT$a7000r_firmware"
    ],
    "weaknesses": [
      "CWE-74",
      "CWE-77"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-01-29T20:45:00+00:00",
        "data": [
          {
            "details": {
              "new": "A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-74",
                "CWE-77"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md",
                "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#poc",
                "https://vuldb.com/?ctiid.343382",
                "https://vuldb.com/?id.343382",
                "https://vuldb.com/?submit.740767",
                "https://www.totolink.net/"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV2_0": {
                  "score": 6.5,
                  "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
                },
                "cvssV3_0": {
                  "score": 6.3,
                  "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
                },
                "cvssV3_1": {
                  "score": 6.3,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
                },
                "cvssV4_0": {
                  "score": 5.3,
                  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "e60497e8-6d5d-42ff-a38d-2cf6d3778add"
      },
      {
        "created": "2026-01-29T22:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "poc",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "685d5e61-adf2-4b1a-9b71-25c07075607a"
      },
      {
        "created": "2026-01-30T09:00:00+00:00",
        "data": [
          {
            "details": [
              "totolink",
              "totolink$PRODUCT$a7000r"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "totolink",
                "totolink$PRODUCT$a7000r"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "44eaec64-34f5-4383-8f20-98e8b15ddd5e"
      },
      {
        "created": "2026-02-10T14:45:00+00:00",
        "data": [
          {
            "details": [
              "totolink$PRODUCT$a7000r_firmware"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:h:totolink:a7000r:-:*:*:*:*:*:*:*",
                "cpe:2.3:o:totolink:a7000r_firmware:4.1cu.4154:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "totolink$PRODUCT$a7000r_firmware"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "c6d00184-5e23-4b07-933c-22f23af1b376"
      },
      {
        "created": "2026-02-23T09:45:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:o:totolink:a7000r_firmware:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "939ff93c-8db3-4f85-929d-6586108501f7"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:h:totolink:a7000r:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:totolink:a7000r_firmware:*:*:*:*:*:*:*:*",
        "cpe:2.3:o:totolink:a7000r_firmware:4.1cu.4154:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-01-29T20:32:08.374000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {
          "score": 6.5,
          "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"
        },
        "provider": "mitre"
      },
      "cvssV3_0": {
        "data": {
          "score": 6.3,
          "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
        },
        "provider": "mitre"
      },
      "cvssV3_1": {
        "data": {
          "score": 6.3,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {
          "score": 5.3,
          "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
        },
        "provider": "mitre"
      },
      "epss": {
        "data": {
          "score": 0.02267
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "poc",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md",
        "https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#poc",
        "https://vuldb.com/?ctiid.343382",
        "https://vuldb.com/?id.343382",
        "https://vuldb.com/?submit.740767",
        "https://www.totolink.net/"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-18T01:30:16.036559+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "totolink",
        "totolink$PRODUCT$a7000r",
        "totolink$PRODUCT$a7000r_firmware"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-74",
        "CWE-77"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-01-29T20:32:08.374000+00:00",
    "description": "A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "poc",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Totolink A7000R cstecgi.cgi setUpgradeFW command injection",
    "updated": "2026-01-29T21:19:19.688000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/1xxx/CVE-2026-1623.json",
    "weaknesses": []
  }
}