CVE-2026-5676

🗓️ 06 Apr 2026 18:15:12Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 31 Views🌐 WEB

Totolink A8000R set language configuration flaw enables remote unauthenticated access via langType.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-5676	6 Apr 202618:15	–	attackerkb
BDU FSTEC	Totolink A8000R Router setLanguageCfg XSS	28 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-5676	6 Apr 202621:20	–	circl
CNNVD	TOTOLINK A8000R: Access Control Vulnerability	6 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-5676 Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication	6 Apr 202618:15	–	cvelist
EUVD	EUVD-2026-19434	6 Apr 202621:31	–	euvd
NVD	CVE-2026-5676	6 Apr 202619:16	–	nvd
Positive Technologies	PT-2026-30700	6 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-5676: Missing Authentication for Critical Function	6 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-5676	7 Apr 202623:01	–	redhatcve

Vulners

Node

totolink a8000rMatch5.9c.681_b20180413

[
  {
    "vendor": "Totolink",
    "product": "A8000R",
    "versions": [
      {
        "version": "5.9c.681_B20180413",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/355503
vuldb	www.vuldb.com/submit/792433
totolink	www.totolink.net/
github	www.github.com/skeetabc/CVE-TOTOLINK-A800R/blob/main/vuln1_auth_bypass.md
vuldb	www.vuldb.com/vuln/355503/cti

Parameter	Position	Path	Description	CWE
langType	query param	/cgi-bin/cstecgi.cgi	The setLanguageCfg function in /cgi-bin/cstecgi.cgi fails to perform proper authentication when the langType parameter is manipulated, leading to missing authentication.	CWE-287, CWE-306

24 Jul 2026 09:10Current

7High risk

Vulners AI Score7

CVSS 46.9

CVSS 3.17.3

CVSS 37.3

CVSS 27.5

EPSS0.00405

SSVC