Description
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Published: 2026-01-19
Score: 5.3 Medium
EPSS: 1.8% Low
KEV: No
Impact: Command Injection
Action: Apply Patch
AI Analysis

Impact

A remote attacker can manipulate the ip argument in a POST request to /cgi-bin/cstecgi.cgi’s setDiagnosisCfg function on the Totolink LR350 router. The flaw allows the execution of arbitrary shell commands on the device, compromising confidentiality, integrity, and availability. The vulnerability maps to path and command injection weaknesses (CWE‑74, CWE‑77).

Affected Systems

Products affected are Totolink LR350 routers running firmware version 9.3.5u.6369_B20220309. No other vendor or product versions are listed as affected at this time.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. An EPSS score of 2% suggests industrial exploitation is possible but unlikely, and the vulnerability is not yet included in CISA’s KEV list. Attackers can trigger the flaw remotely via HTTP POST to the router’s exposed interface. Public exploits are available, so the risk is real. The flaw appears exploitable without authentication according to the description, but the exact authentication requirements are not specified, so that detail is inferred as potentially unauthenticated.

Generated by OpenCVE AI on April 18, 2026 at 05:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied firmware update that patches the command injection bug on the LR350.
  • If an update is not yet available, block or firewall access to the router’s management interface from untrusted networks and isolate the device in a protected zone.
  • If possible, disable or remove the setDiagnosisCfg service via the router’s administration console to mitigate the risk until a patch can be applied.

Generated by OpenCVE AI on April 18, 2026 at 05:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:totolink:lr350_firmware:*:*:*:*:*:*:*:*

Thu, 29 Jan 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink lr350 Firmware
CPEs cpe:2.3:h:totolink:lr350:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:lr350_firmware:9.3.5u.6369_b20220309:*:*:*:*:*:*:*
Vendors & Products Totolink lr350 Firmware

Tue, 20 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink lr350
Vendors & Products Totolink
Totolink lr350

Mon, 19 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Title Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink Lr350 Lr350 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:44:46.571Z

Reserved: 2026-01-18T13:55:26.431Z

Link: CVE-2026-1149

cve-icon Vulnrichment

Updated: 2026-01-20T16:31:45.652Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-19T10:16:08.877

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1149

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T05:30:25Z

Weaknesses