Is there a public PoC exploit available for CVE-2026-5676?

Yes, a public proof-of-concept exploit is available for CVE-2026-5676. Prioritise patching immediately. EPSS: 0.1%.

A8000R CVE-2026-5676

Q: What is the CVSS score of CVE-2026-5676?

CVE-2026-5676 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19434 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-06 VulDB

Authentication Bypass TOTOLINK A8000R

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 19:00 euvd

EUVD-2026-19434

Analysis Generated

Apr 06, 2026 - 19:00 vuln.today

CVE Published

Apr 06, 2026 - 18:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

Authentication bypass in Totolink A8000R 5.9c.681_B20180413 allows remote attackers to manipulate the langType parameter in the setLanguageCfg function at /cgi-bin/cstecgi.cgi to bypass authentication controls without credentials. This unauthenticated remote vulnerability has publicly available exploit code and poses a confirmed risk to exposed router management interfaces.

Technical ContextAI

The vulnerability exists in the CGI script handler cstecgi.cgi on Totolink A8000R routers, which processes configuration requests including language settings. The setLanguageCfg function fails to properly validate authentication credentials before processing the langType parameter, violating CWE-306 (Missing Authentication for Critical Function). An attacker can directly manipulate this parameter via HTTP requests to the router's web interface without providing valid authentication credentials, bypassing the intended access control mechanism that should protect administrative functions.

RemediationAI

Update Totolink A8000R to a patched firmware version newer than 5.9c.681_B20180413. Users should check the official Totolink support page at https://www.totolink.net/ for available firmware updates addressing CVE-2026-5676. As a temporary workaround pending firmware updates, restrict network access to the router's management interface by disabling remote administration features and limiting web interface access to trusted local networks only. If the router is exposed to the internet, immediately apply network-level restrictions such as firewall rules blocking access to port 80/443 from untrusted sources until a patch is deployed.