CVE-2026-82616
CriticalCVSS 9.9Summary
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been made public.
Risk Assessment
A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, potentially leading to full compromise of the router and network security breach.
Recommendation
Immediately update the router firmware to the latest available version if a patch is released. If no patch is available, restrict access to the administrative interface and monitor network traffic.
Other vulnerabilities in TOTOLINK NR1800X
See all- CVE-2026-82597High
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUssd function of /cgi-bin/cstecgi.cgi. Manipulation of the ussd argument leads to command injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-7548High
A vulnerability was detected in Totolink NR1800X version 9.1.0u.6279_B20210910, affecting the function sub_41A68C in the file /cgi-bin/cstecgi.cgi. Manipulating the argument setUssd results in command injection.
- CVE-2026-1328High
A vulnerability was detected in Totolink NR1800X router version 9.1.0u.6279_B20210910. It affects the setWizardCfg function in the file /cgi-bin/cstecgi.cgi of the POST Request Handler component. Manipulating the ssid argument leads to a buffer overflow. The attack can be initiated remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.