PT-2026-3940 · Totolink · Totolink Nr1800X

Yhryhryhr_Mie · Publicado 2026-01-22 · Atualizado 2026-01-22 · CVE-2026-1328

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A buffer overflow issue exists in the setWizardCfg function within the /cgi-bin/cstecgi.cgi file of the POST Request Handler component. Manipulating the ssid argument can trigger this issue. The attack can be initiated remotely. The exploit is publicly available.

Recommendations For Totolink NR1800X version 9.1.0u.6279 B20210910, restrict access to the /cgi-bin/cstecgi.cgi file or disable the setWizardCfg function until a patch is available.

Exploit

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-120

CWE-119

Identificadores relacionados

BDU:2026-00853

CVE-2026-1328

Produtos afetados

Totolink Nr1800X

Referências · 14

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9?source=copy_link · Exploit
• https://vuldb.com/?ctiid.342304 · Nota
• https://vuldb.com/?submit.735792 · Nota
• https://bdu.fstec.ru/vul/2026-00853 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2014362211448156241 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014350123363336689 · Publicação no Twitter
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9 · Nota
• https://totolink.net · Nota
• https://twitter.com/lsof/status/2014399643610661369 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1328 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014384299231826357 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1328 · Nota de Segurança
• https://t.me/CVEtracker/42788 · Publicação no Telegram
• https://vuldb.com/?id.342304 · Nota