CVE-2026-5020
Published: 29 March 2026
Summary
CVE-2026-5020 is a medium-severity Injection (CWE-74) vulnerability in Totolink A3600R Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the NoticeUrl parameter in the setNoticeCfg function of the vulnerable CGI script.
Ensures timely remediation of the specific command injection flaw through firmware patching on the Totolink A3600R router.
Mitigates exploitation by enforcing least privilege to restrict low-privilege authenticated users from accessing the vulnerable Parameter Handler component.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web CGI in router firmware directly facilitates exploitation of public-facing application (T1190) and enables execution of commands on network device CLI (T1059.008).
NVD Description
A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNoticeCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument NoticeUrl results in command injection. The attack may be launched…
more
remotely. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-5020 is a command injection vulnerability affecting the Totolink A3600R router on firmware version 4.1.2cu.5182_B20201102. The flaw resides in the setNoticeCfg function of the /cgi-bin/cstecgi.cgi file within the Parameter Handler component, where manipulation of the NoticeUrl argument enables command injection. Published on 2026-03-29, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs-74 and CWE-77.
The vulnerability is exploitable remotely over the network with low attack complexity, requiring low privileges such as an authenticated user account and no user interaction. Attackers can inject commands via the NoticeUrl parameter, potentially leading to limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or service disruption on the affected device.
Advisories and further details are documented in references including VulDB entries (vuldb.com/vuln/353905 and related pages) and a public exploit proof-of-concept on a Notion site. The vendor site at www.totolink.net provides additional context, though specific patch information is not detailed in the primary disclosure.
The exploit is public and available for use, increasing the risk of real-world exploitation against unpatched Totolink A3600R devices.
Details
- CWE(s)