Description
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
Published: 2026-08-25
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Command injection is possible in the getCurrentTime function of /cgi-bin/cstecgi.cgi when the ntp_server argument is manipulated. The flaw allows an attacker to inject and execute arbitrary commands on the router’s operating system, compromising confidentiality, integrity, and availability of the device and potentially the networks it serves.

Affected Systems

The vulnerability affects TOTOLINK N600R routers running firmware 4.3.0cu.7647_B20210106. No other affected versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the exploit is publicly available with no reported exploitation restrictions. Remote attackers can leverage the injection without local access. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but its public exploit and remote nature increase its threat posture.

Generated by OpenCVE AI on August 26, 2026 at 01:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a firmware update that removes the vulnerable getCurrentTime function or patches the ntp_server handling; vendors normally release such updates through their official support channels.
  • If an immediate firmware update is not available, block access to the /cgi-bin/cstecgi.cgi endpoint and restrict NTP server configuration changes to trusted administrators only.
  • Continuously monitor router logs for unexpected command execution patterns or abnormal NTP traffic that might indicate an attempt to exploit the injection flaw.

Generated by OpenCVE AI on August 26, 2026 at 01:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Totolink n600r
Vendors & Products Totolink n600r

Tue, 25 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
Title TOTOLINK N600R cstecgi.cgi getCurrentTime command injection
First Time appeared Totolink
Totolink n600r Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink n600r Firmware
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Totolink N600r N600r Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-25T22:30:12.494Z

Reserved: 2026-08-25T14:57:22.695Z

Link: CVE-2026-79912

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T23:17:59.663

Modified: 2026-08-25T23:17:59.663

Link: CVE-2026-79912

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T01:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')