CVE-2026-5020 is a medium severity (CVSS 6.3) command injection in Totolink A3600R firmware. The setNoticeCfg function in /cgi-bin/cstecgi.cgi passes the NoticeUrl argument into a command, and the record says an exploit is public. No fixed firmware is named, so check Totolink and limit access.
What's affected
- Product: Totolink A3600R, firmware as listed in the record.
- Function and argument:
setNoticeCfgin/cgi-bin/cstecgi.cgi, argumentNoticeUrl. - Component: Parameter Handler.
- Fixed firmware: none stated in the record. Check totolink.net for an update.
- Weaknesses: CWE-77, command injection, and CWE-74, injection.
- CVSS 6.3 (medium), vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Low privileges are needed. - Published 29 March 2026. Not marked as exploited in CISA KEV, though the record says the exploit has been disclosed.
How to check if you're exposed
Log in to the router admin page and note the model and firmware version from the status or system page. Compare it with the version in the record, then check the Totolink download page for newer firmware for your model.
Also check exposure. From outside your network, confirm that the admin interface and any Telnet or web management ports are not reachable. Then list who has an account on the device, because the vector says a login is needed.
What to do now
- Check the Totolink site for newer firmware for your model and install it if one is offered. The record does not name a fixed version.
- Turn off remote management and Telnet, and keep the admin page reachable only from a trusted wired network.
- Change the admin password to a long unique one, and remove accounts you do not need.
- Put the router behind a device you can update, or replace it if the vendor no longer issues fixes for this model.
- Watch for odd outbound connections from the router.
Why it matters
Home and small office routers run web programs that call system commands. When an argument is handed to a command without cleaning it, the person sending it chooses what runs. The record places this in CWE-77 and the family CWE-74, and says exploit details are public.
Devices like this often get few updates, so the safe approach is to limit who can reach them and to plan replacement when support ends.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Does this need a login?
The vector says low privileges are required, so an account on the device is needed. Weak or default passwords make that easier, so change them.
Sources
- Totolink (named in the record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
