EUVD-2026-19434Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents moderate-to-high real-world risk. The CVSS 6.9 score reflects unauthenticated network access (AV:N, PR:N) with low complexity (AC:L), resulting in limited confidentiality and integrity impact (VC:L, VI:L, VA:L). The CVSS vector indicates proof-of-concept exploitation evidence (E:P). Critically, the combination of unauthenticated remote access, publicly available exploit code, and CWE-306 authentication bypass creates significant risk for any Totolink A8000R exposed to untrusted networks. The authentication bypass itself is the technical impact-once exploited, an attacker gains unauthorized access to router configuration functions. This is a higher real-world priority than raw CVSS might suggest due to the complete absence of authentication requirements and public exploit availability. |
| Exploit ScenarioDerived | An attacker on the internet crafts an HTTP request to a Totolink A8000R router (identified via port scanning or shodan queries) and sends a malformed request to /cgi-bin/cstecgi.cgi with a crafted langType parameter. Because the setLanguageCfg function lacks authentication checks, the request succeeds without providing credentials, allowing the attacker to modify router configuration. Publicly available exploit code from GitHub (https://github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.md) demonstrates this technique, making exploitation trivial for even unskilled attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Authentication bypass in Totolink A8000R 5.9c.681_B20180413 allows remote attackers to manipulate the langType parameter in the setLanguageCfg function at /cgi-bin/cstecgi.cgi to bypass authentication controls without credentials. This unauthenticated remote vulnerability has publicly available exploit code and poses a confirmed risk to exposed router management interfaces.
RemediationAI
Update Totolink A8000R to a patched firmware version newer than 5.9c.681_B20180413. Users should check the official Totolink support page at https://www.totolink.net/ for available firmware updates addressing CVE-2026-5676. As a temporary workaround pending firmware updates, restrict network access to the router's management interface by disabling remote administration features and limiting web interface access to trusted local networks only. If the router is exposed to the internet, immediately apply network-level restrictions such as firewall rules blocking access to port 80/443 from untrusted sources until a patch is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the CGI script handler cstecgi.cgi on Totolink A8000R routers, which processes configuration requests including language settings. The setLanguageCfg function fails to properly validate authentication credentials before processing the langType parameter, violating CWE-306 (Missing Authentication for Critical Function). An attacker can directly manipulate this parameter via HTTP requests to the router's web interface without providing valid authentication credentials, bypassing the intended access control mechanism that should protect administrative functions.
Know when A8000R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB