High severity7.3NVD Advisory· Published Apr 6, 2026· Updated Apr 29, 2026

CVE-2026-5676

Description

A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.mdnvd
vuldb.com/submit/792433nvd
vuldb.com/vuln/355503nvd
vuldb.com/vuln/355503/ctinvd
www.totolink.netnvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000