PT-2026-3936 · Totolink · Totolink Nr1800X

Yhryhryhr_Tu · Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-1326

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A flaw exists in Totolink NR1800X version 9.1.0u.6279 B20210910 that allows for command injection. The issue is located within the setWanCfg function of the /cgi-bin/cstecgi.cgi file, specifically in the POST Request Handler component. Manipulation of the Hostname argument can lead to unauthorized command execution. This attack can be initiated remotely, and an exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2026-00852

CVE-2026-1326

Affected Products

Totolink Nr1800X

References · 12

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWanCfg-2e453a41781f80b390f3e1ce0d9dd5b9?source=copy_link · Exploit
• https://osv.dev/vulnerability/CVE-2026-1326 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00852 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1326 · Security Note
• https://vuldb.com/?id.342302 · Note
• https://twitter.com/VulmonFeeds/status/2014389419499790611 · Twitter Post
• https://vuldb.com/?submit.735787 · Note
• https://twitter.com/CVEnew/status/2014339296061202886 · Twitter Post
• https://t.me/CVEtracker/42782 · Telegram Post
• https://totolink.net · Note
• https://vuldb.com/?ctiid.342302 · Note
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWanCfg-2e453a41781f80b390f3e1ce0d9dd5b9 · Note