CVE-2026-1158
HighSummary
A buffer overflow vulnerability has been discovered in the Totolink LR350 9.3.5u.6369_B20220309 in the setWizardCfg function of /cgi-bin/cstecgi.cgi. The attack involves manipulating the ssid argument in a POST request and can be performed remotely. The exploit has been publicly released, increasing the risk of exploitation.
Risk Assessment
The organization may be exposed to remote code execution or device crash, potentially leading to network outages or data integrity compromise.
Recommendation
It is recommended to immediately update the firmware of the Totolink LR350 to the latest available version if a patch is provided. If not, restrict external access to the admin panel and monitor network traffic.
Other vulnerabilities in Totolink LR350
See all- CVE-2026-1157High
Vulnerability in Totolink LR350 router in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-1156High
Vulnerability in Totolink LR350 router in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly disclosed.
- CVE-2026-1155High
Vulnerability in Totolink LR350 router in the setWiFiEasyGuestCfg function of /cgi-bin/cstecgi.cgi. Manipulation of the ssid argument causes a buffer overflow. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2023-37149Critical
The TOTOLINK LR350 device version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
- CVE-2023-37148Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the ussd parameter in the setUssd function.
- CVE-2023-37146Critical
The TOTOLINK LR350 version V9.3.5u.6369_B20220309 was found to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
Original NVD description (English source)
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.