PT-2026-36294 · Totolink · Nr1800X

Newym · Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-7548

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279 B20210910. This affects the function sub 41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-7548

Affected Products

Nr1800X

References · 6

• 🔥 https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7548 · Security Note
• https://vuldb.com/vuln/360358 · Note
• https://vuldb.com/submit/804417 · Note
• https://totolink.net · Note
• https://vuldb.com/vuln/360358/cti · Note