CVE-2026-7548

Totolink NR1800X cstecgi.cgi sub_41A68C command injection

CVSS 8.7 HIGHEPSS 1.5%CWE-74 CWE-77

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Affected products

Totolink · NR1800X

public PoCs found — 1

cve_referencegithub.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md https://vuldb.com/submit/804417 https://vuldb.com/vuln/360358 https://vuldb.com/vuln/360358/cti https://www.totolink.net/