PT-2026-3940 · Totolink · Totolink Nr1800X

Yhryhryhr_Mie · Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-1328

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A buffer overflow issue exists in the setWizardCfg function within the /cgi-bin/cstecgi.cgi file of the POST Request Handler component. Manipulating the ssid argument can trigger this issue. The attack can be initiated remotely. The exploit is publicly available.

Recommendations For Totolink NR1800X version 9.1.0u.6279 B20210910, restrict access to the /cgi-bin/cstecgi.cgi file or disable the setWizardCfg function until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

CWE-119

Related Identifiers

BDU:2026-00853

CVE-2026-1328

Affected Products

Totolink Nr1800X

References · 14

• 🔥 https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9?source=copy_link · Exploit
• https://bdu.fstec.ru/vul/2026-00853 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1328 · Security Note
• https://vuldb.com/?ctiid.342304 · Note
• https://vuldb.com/?submit.735792 · Note
• https://twitter.com/CveFindCom/status/2014362211448156241 · Twitter Post
• https://twitter.com/CVEnew/status/2014350123363336689 · Twitter Post
• https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9 · Note
• https://totolink.net · Note
• https://twitter.com/lsof/status/2014399643610661369 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014384299231826357 · Twitter Post
• https://t.me/CVEtracker/42788 · Telegram Post
• https://vuldb.com/?id.342304 · Note