CVE-2026-1155
HighSummary
Vulnerability in Totolink LR350 router in the setWiFiEasyGuestCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can exploit the buffer overflow to take control of the device or cause a denial of service, compromising network security.
Recommendation
Update the router firmware to the latest version if available, or restrict access to the administrative interface from trusted networks.
Other vulnerabilities in Totolink LR350
See all- CVE-2026-1158High
A buffer overflow vulnerability has been discovered in the Totolink LR350 9.3.5u.6369_B20220309 in the setWizardCfg function of /cgi-bin/cstecgi.cgi. The attack involves manipulating the ssid argument in a POST request and can be performed remotely. The exploit has been publicly released, increasing the risk of exploitation.
- CVE-2026-1157High
Vulnerability in Totolink LR350 router in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-1156High
Vulnerability in Totolink LR350 router in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2023-37149Critical
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
- CVE-2023-37148Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.
- CVE-2023-37146Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Original NVD description (English source)
A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.