CVE-2026-82555mediumCWE-310CWE-330

CVE-2026-82555: medium-severity vulnerability in TOTOLINK N600R

TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values

Published · Updated

Follow this CVE+ Monitor N600R

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.3epss 0.7%
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
TOTOLINK · N600R
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — TOTOLINK N600R

In the same product, most dangerous first.

CVE-2025-9935MEDIUMTOTOLINK N600R cstecgi.cgi sub_4159F8 command injectionEPSS 2.7%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2025-4496HIGHTOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflowEPSS 1.2%CVE-2025-8181HIGHTOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violationEPSS 1.1%CVE-2026-79911CRITICALTOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflowEPSS 1.1%CVE-2025-11444HIGHTOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflowEPSS 1.1%