CVE-2026-1547 | Totolink A7000R 4.1cu.4154 /cgi-bin/cstecgi.cgi setUnloadUserData plugin_name command injection

A vulnerability was found in Totolink A7000R 4.1cu.4154. It has been declared as critical. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection.

This vulnerability is known as CVE-2026-1547. It is possible to launch the attack remotely. Furthermore, an exploit is available.