CVE-2026-7548
HighSummary
A vulnerability was detected in Totolink NR1800X version 9.1.0u.6279_B20210910, affecting the function sub_41A68C in the file /cgi-bin/cstecgi.cgi. Manipulating the argument setUssd results in command injection.
Risk Assessment
The attack can be carried out remotely, increasing the risk of exploitation by unauthorized users.
Recommendation
It is recommended to update the device to the latest firmware version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Totolink NR1800X 9.1.0u.6279_B20210910
See all- CVE-2026-82597High
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUssd function of /cgi-bin/cstecgi.cgi. Manipulation of the ussd argument leads to command injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-1328High
A vulnerability was detected in Totolink NR1800X router version 9.1.0u.6279_B20210910. It affects the setWizardCfg function in the file /cgi-bin/cstecgi.cgi of the POST Request Handler component. Manipulating the ssid argument leads to a buffer overflow. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-82616Critical
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.