CVE-2026-5676
Published: 06 April 2026
Summary
CVE-2026-5676 is a medium-severity Improper Authentication (CWE-287) vulnerability in Totolink A8000R (inferred from references). Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-5676 is a missing authentication vulnerability affecting the Totolink A8000R router on firmware version 5.9c.681_B20180413. The flaw exists in the setLanguageCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the langType argument enables authentication bypass. It is associated with CWEs-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by unauthenticated attackers over the network with low attack complexity and no requirement for user interaction. Exploitation allows limited impacts on confidentiality, integrity, and availability, such as unauthorized access to certain functions. A public exploit is available, increasing the risk of widespread use.
Advisories and additional details are documented in references including a GitHub repository detailing the authentication bypass (https://github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.md), VulDB entries (https://vuldb.com/submit/792433, https://vuldb.com/vuln/355503, https://vuldb.com/vuln/355503/cti), and the Totolink vendor site (https://www.totolink.net/). No specific mitigation or patch details are outlined in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19434
Vulnerability details
A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and…
more
might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an authentication bypass vulnerability in a public-facing web CGI endpoint (/cgi-bin/cstecgi.cgi) on a network router, directly enabling remote unauthenticated exploitation of a public-facing application for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly prohibits unauthorized actions without identification or authentication, such as manipulating the langType argument in setLanguageCfg to bypass authentication.
IA-8 requires unique identification and authentication for non-organizational users, preventing remote unauthenticated access to the vulnerable CGI endpoint.
AC-3 enforces approved access authorizations, blocking unauthorized manipulation of critical functions like setLanguageCfg in cstecgi.cgi.