PT-2026-28742 · Totolink · Totolink Nr1800X

Wxhwxhwxh_Mie · Published 2026-03-29 · Updated 2026-03-29 · CVE-2026-5030

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A command injection issue exists in the Telnet Service component of Totolink NR1800X. The issue is located in the NTPSyncWithHost function within the /cgi-bin/cstecgi.cgi file. Manipulation of the host time argument can lead to command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

Recommendations Totolink NR1800X version 9.1.0u.6279 B20210910: As a temporary workaround, consider disabling the Telnet Service to minimize the risk of exploitation. Avoid using the host time argument in the /cgi-bin/cstecgi.cgi file until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-5030

Affected Products

Totolink Nr1800X

References · 9

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-NTPSyncWithHost-32153a41781f8032afebc0802b704e9c?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5030 · Security Note
• https://vuldb.com/vuln/353952/cti · Note
• https://twitter.com/CVEarity/status/2038274830857064651 · Twitter Post
• https://vuldb.com/submit/778529 · Note
• https://twitter.com/cyberbivash/status/2038153396532695250 · Twitter Post
• https://totolink.net · Note
• https://twitter.com/CVEnew/status/2038135148651360569 · Twitter Post
• https://vuldb.com/vuln/353952 · Note