Description
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-01-22
Score: 5.3 Medium
EPSS: 2.4% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits attackers to inject arbitrary commands via the setTracerouteCfg argument of the /cgi-bin/cstecgi.cgi POST handler. This allows remote execution of shell commands on the affected router, which can lead to full compromise of the device, loss of confidentiality, integrity, and availability.

Affected Systems

Totolink NR1800X routers running firmware version 9.1.0u.6279_B20210910 are affected. The vulnerability exists in the POST Request Handler component where the cstecgi.cgi script processes traceroute configuration requests.

Risk and Exploitability

The CVSS v3.1 score of 5.3 indicates moderate severity, while the EPSS score of 2% indicates a low but nonzero likelihood of exploitation at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack can be launched remotely by sending a crafted POST request that manipulates the command parameter, leading to arbitrary code execution without requiring prior authentication or local access.

Generated by OpenCVE AI on June 18, 2026 at 05:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to the latest version that contains the command injection fix, which also updates input validation and authentication controls (CWE‑74, CWE‑77).
  • Block or restrict unauthenticated access to the /cgi-bin/cstecgi.cgi POST endpoint, thereby limiting the ability to invoke setTracerouteCfg without proper authorization (CWE‑77).
  • Enforce strict input validation on the setTracerouteCfg parameter to reject malformed or suspicious command strings, reducing the risk of injection (CWE‑74).

Generated by OpenCVE AI on June 18, 2026 at 05:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:totolink:nr1800x_firmware:*:*:*:*:*:*:*:*

Thu, 29 Jan 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Totolink nr1800x Firmware
CPEs cpe:2.3:h:totolink:nr1800x:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6279_b20210910:*:*:*:*:*:*:*
Vendors & Products Totolink nr1800x Firmware

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink nr1800x
Vendors & Products Totolink
Totolink nr1800x

Thu, 22 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Title Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Totolink Nr1800x Nr1800x Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:53:00.325Z

Reserved: 2026-01-22T07:43:45.318Z

Link: CVE-2026-1327

cve-icon Vulnrichment

Updated: 2026-01-22T14:31:42.652Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-22T15:16:50.967

Modified: 2026-06-17T10:15:36.433

Link: CVE-2026-1327

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T05:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')