CVE-2026-1623

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

• CWE-74
• CWE-77

• https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.mdExploit, Third Party Advisory
• https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/04_RCE_setUpgradeFW_RCE.md#pocExploit
• https://vuldb.com/?ctiid.343382Permissions Required, VDB Entry
• https://vuldb.com/?id.343382Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.740767Third Party Advisory, VDB Entry
• https://www.totolink.net/Product

Published

Jan 29, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16224A vulnerability was identified in jxxghp MoviePilot up to 2.…5.3
• CVE-2026-16225A security flaw has been discovered in davenardella snap7 up…6.3
• CVE-2026-16226A weakness has been identified in SourceCodester Pizzafy Eco…5.1
• CVE-2026-16227A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-16228A vulnerability was detected in SourceCodester Class and Exa…7.3
• CVE-2026-16229A flaw has been found in itsourcecode Courier Management Sys…4.3
• CVE-2026-16230The Formidable Digital Signatures plugin for WordPress is vu…9.8
• CVE-2026-16232An authentication bypass vulnerability in the Check Point Sm…9.8
• CVE-2026-16235Crypt::Password versions through 0.28 for Perl generate inse…9.8
• CVE-2026-16236The Realtyna Organic IDX plugin for WordPress is vulnerable …8.8
• CVE-2026-1624A security vulnerability has been detected in D-Link DWR-M96…8.8
• CVE-2026-16242A flaw was found in the Konnectivity proxy-server configurat…9.4