CVE-2026-1158: falha de alta gravidade em Totolink LR350
Totolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflow
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.7%
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
Totolink · LR350CVEs relacionadas — Totolink LR350
No mesmo produto, das mais perigosas para as menos.
CVE-2026-1149MEDIUMTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injectionEPSS 3.0%CVE-2026-1150MEDIUMTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injectionEPSS 2.6%CVE-2026-1157HIGHTotolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflowEPSS 1.0%CVE-2026-1155HIGHTotolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflowEPSS 0.9%CVE-2026-1156HIGHTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowEPSS 0.7%CVE-2026-4976HIGHTotolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflowEPSS 0.7%