Cyber Posture

CVE-2026-5020

MediumPublic PoC

Published: 29 March 2026

Published
29 March 2026
Modified
30 March 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0192 83.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched…

more

remotely. The exploit is now public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by requiring validation of the NoticeUrl parameter in the setNoticeCfg function of the vulnerable CGI script.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific command injection flaw through firmware patching on the Totolink A3600R router.

AC-6 Least Privilege partial match
prevent

Mitigates exploitation by enforcing least privilege to restrict low-privilege authenticated users from accessing the vulnerable Parameter Handler component.

Security SummaryAI

CVE-2026-5020 is a command injection vulnerability affecting the Totolink A3600R router on firmware version 4.1.2cu.5182_B20201102. The flaw resides in the setNoticeCfg function of the /cgi-bin/cstecgi.cgi file within the Parameter Handler component, where manipulation of the NoticeUrl argument enables command injection. Published on 2026-03-29, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs-74 and CWE-77.

The vulnerability is exploitable remotely over the network with low attack complexity, requiring low privileges such as an authenticated user account and no user interaction. Attackers can inject commands via the NoticeUrl parameter, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or service disruption on the affected device.

Advisories and further details are documented in references including VulDB entries (vuldb.com/vuln/353905 and related pages) and a public exploit proof-of-concept on a Notion site. The vendor site at www.totolink.net provides additional context, though specific patch information is not detailed in the primary disclosure.

The exploit is public and available for use, increasing the risk of real-world exploitation against unpatched Totolink A3600R devices.

Details

CWE(s)
CWE-74CWE-77

Affected Products

totolink
a3600r firmware
4.1.2cu.5182_b20201102

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection via web CGI in router firmware directly facilitates exploitation of public-facing application (T1190) and enables execution of commands on network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References