CVE-2026-79912
HighCVSS 8.3Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
Risk Assessment
The risk to the organization includes remote execution of arbitrary commands on the device, which could lead to full compromise of the router and interception of network traffic. The public exploit increases the likelihood of attack.
Recommendation
It is recommended to immediately update the TOTOLINK N600R firmware to the latest version if available. Also restrict access to the administrative panel and monitor network traffic.
Other vulnerabilities in TOTOLINK N600R
See all- CVE-2026-79911Critical
TOTOLINK N600R 4.3.0cu.7647_B20210106 has a stack-based buffer overflow vulnerability in the setSystemConfig function of /cgi-bin/cstecgi.cgi. Manipulation of the Hostname argument leads to buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
- CVE-2025-51390Critical
A command injection vulnerability was discovered in the TOTOLINK N600R router running firmware version V4.3.0cu.7647_B20210106. The issue resides in the setWiFiWpsConfig function via the pin parameter.
- CVE-2025-46060Critical
A buffer overflow vulnerability was found in the TOTOLINK N600R router firmware version 4.3.0cu.7866_B2022506. A remote attacker can exploit the UPLOAD_FILENAME component to execute arbitrary code.
Original NVD description (English source)
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.