CVE-2026-1547 is a command injection flaw in TOTOLINK A7000R firmware 4.1cu.4154, rated 6.3 (medium). The record describes the weak spot as the file /cgi-bin/cstecgi.cgi, reached through the plugin_name argument. No patched version is listed, so the safe choices are to stop using the software, or to isolate it behind strict controls.
What's affected
- Product: TOTOLINK A7000R.
- Affected: firmware 4.1cu.4154.
- Fixed version: none is listed in the CVE record or the references. Check the vendor or project site for an update.
- Weakness: CWE-74, CWE-77. The record describes it as remotely reachable, and says exploit details have been made public. It is not on the CISA Known Exploited Vulnerabilities list, so the record does not claim active attacks.
- Function: the record names setUnloadUserData in the CGI program.
How to check if you're exposed
Look for the product in your own estate first. This kind of software is often a downloaded sample or starter project that someone copied onto a server and forgot.
find / -type f -name "cstecgi.cgi" 2>/dev/null
Search web roots for the file named in the record. If you find it, note whether the site is reachable from the internet, and who owns it.
Next, check the web server logs for requests to that file. Requests with unusual characters in the plugin_name argument, or a burst of errors from the database, are worth a closer look. They do not prove a breach, but they show whether someone has been probing.
If you cannot find the product, you are probably not running it. Scanning dependencies and deployed files across your repositories is a quick way to be sure.
What to do now
- Decide whether you need A7000R at all. If not, remove it from every server.
- If you must keep it, take it off the public internet. Put it behind a VPN or an allowlist.
- Check the vendor site for a firmware or software update, and apply it if one exists.
- Restrict management interfaces to a trusted network.
- Review logs for unusual requests, and change any credentials that may have been exposed.
Why it matters
Command injection happens when a program passes user supplied text into a system command without separating the data from the instructions. A device that runs its web interface with high privileges makes the result worse, because commands run with those privileges. CWE-74 is the broader class for injection into another component, and CWE-77 covers command injection specifically.
Routers and similar devices are slow to receive fixes, and many models stop getting them entirely. When no fixed firmware is listed, the realistic answer is to limit who can reach the management interface and to plan a replacement for the device.
Exploit details for this entry are public, according to the record. That makes it more likely that scanners will look for it on devices that expose their web interface to the internet.
Quick check
Is there a patch?
None is listed in the record or the references. Check the TOTOLINK site for updates, and if there is none, treat the software as unsupported.
Is this being exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list. It does say that exploit details are public, so the risk of probing is real.
Sources
Last reviewed: 19 October 2026.
