PT-2026-3936 · Totolink · Totolink Nr1800X

Yhryhryhr_Tu · Publicado 2026-01-22 · Atualizado 2026-01-22 · CVE-2026-1326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A flaw exists in Totolink NR1800X version 9.1.0u.6279 B20210910 that allows for command injection. The issue is located within the setWanCfg function of the /cgi-bin/cstecgi.cgi file, specifically in the POST Request Handler component. Manipulation of the Hostname argument can lead to unauthorized command execution. This attack can be initiated remotely, and an exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2026-00852

CVE-2026-1326

Produtos afetados

Totolink Nr1800X

Referências · 12

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWanCfg-2e453a41781f80b390f3e1ce0d9dd5b9?source=copy_link · Exploit
• https://vuldb.com/?id.342302 · Nota
• https://twitter.com/VulmonFeeds/status/2014389419499790611 · Publicação no Twitter
• https://vuldb.com/?submit.735787 · Nota
• https://twitter.com/CVEnew/status/2014339296061202886 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1326 · Aviso do Fabricante
• https://t.me/CVEtracker/42782 · Publicação no Telegram
• https://totolink.net · Nota
• https://vuldb.com/?ctiid.342302 · Nota
• https://bdu.fstec.ru/vul/2026-00852 · Nota de Segurança
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWanCfg-2e453a41781f80b390f3e1ce0d9dd5b9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1326 · Nota de Segurança