CVE-2026-1149: falha de média gravidade em Totolink LR350
Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 3.0%
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Totolink · LR350CVEs relacionadas — Totolink LR350
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1150MEDIUMTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injectionEPSS 2.6%CVE-2026-1157HIGHTotolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflowEPSS 1.0%CVE-2026-1155HIGHTotolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflowEPSS 0.9%CVE-2026-1158HIGHTotolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflowEPSS 0.7%CVE-2026-1156HIGHTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowEPSS 0.7%CVE-2026-4976HIGHTotolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflowEPSS 0.7%