CVE-2026-1157
HighSummary
Vulnerability in Totolink LR350 router in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can exploit the buffer overflow to take control of the device or cause a denial of service, compromising network security.
Recommendation
Update the router firmware to the latest version if available, or restrict access to the administrative interface from trusted networks.
Other vulnerabilities in Totolink LR350
See all- CVE-2026-1158High
A buffer overflow vulnerability has been discovered in the Totolink LR350 9.3.5u.6369_B20220309 in the setWizardCfg function of /cgi-bin/cstecgi.cgi. The attack involves manipulating the ssid argument in a POST request and can be performed remotely. The exploit has been publicly released, increasing the risk of exploitation.
- CVE-2026-1156High
Vulnerability in Totolink LR350 router in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-1155High
Vulnerability in Totolink LR350 router in the setWiFiEasyGuestCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2023-37149Critical
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
- CVE-2023-37148Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.
- CVE-2023-37146Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Original NVD description (English source)
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.