CVE-2026-5676
Authentication Bypass in Totolink A8000R setLanguageCfg Function
Publication date: 2026-04-06
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a8000r | 5.9c.681_b20180413 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5676 is an authentication bypass vulnerability in the TOTOLINK A800R router running firmware version V5.9c.681_B20180413. The issue exists in the /cgi-bin/cstecgi.cgi binary, specifically in the setLanguageCfg function, where the argument langType can be manipulated to bypass authentication.
The vulnerability occurs because the cstecgi.cgi script does not verify session cookies or authentication tokens before processing POST requests. Although the lighttpd web server is supposed to enforce authentication, its configuration does not require authentication for POST requests to this CGI endpoint, allowing remote attackers to invoke critical functions without any credentials.
A proof-of-concept shows that sending a POST request with JSON data to /cgi-bin/cstecgi.cgi without any authentication results in a successful response, confirming the bypass.
How can this vulnerability impact me? :
This vulnerability allows unauthenticated remote attackers to modify any device configuration on the affected TOTOLINK A800R router.
- Attackers can change WiFi settings.
- Attackers can alter administrator passwords.
- Attackers can modify firewall rules.
- There is potential for attackers to execute arbitrary commands through related command injection vulnerabilities.
Overall, this leads to a severe security risk, compromising the confidentiality, integrity, and availability of the device and network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending a POST request to the /cgi-bin/cstecgi.cgi endpoint without any authentication tokens or cookies and observing if the device responds successfully.
A suggested command to test this is using curl to send a POST request with JSON data to the vulnerable endpoint and check for a success response.
- curl -X POST http://<target-ip>/cgi-bin/cstecgi.cgi -d '{"langType":"en"}' -H 'Content-Type: application/json'
If the response contains {"success":true} without requiring authentication, it confirms the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /cgi-bin/cstecgi.cgi endpoint to trusted networks only, such as by using firewall rules or network segmentation.
Additionally, disabling remote management or administration features on the affected device until a patch or firmware update is available is recommended.
Monitoring network traffic for suspicious POST requests to /cgi-bin/cstecgi.cgi and blocking unauthorized attempts can also help reduce risk.
Ultimately, applying an official firmware update from the vendor that addresses this authentication bypass vulnerability is the most effective solution.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote attackers to modify device configurations, including administrator passwords and firewall rules, which can lead to unauthorized access and potential data breaches.
Such unauthorized access and potential compromise of device security can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal data and secure system access.
Specifically, failure to enforce authentication and the ability to alter security settings remotely may result in violations of data protection and security requirements mandated by these regulations.