CVE-2026-1149

2.1 lowEPSS 3.0%

Low (2.1) in totolink lr350 firmware. EPSS 3.0% chance of exploitation in the next 30 days.

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-77
Published: 2026-01-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:lr350_firmware

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setDiagnosisCfg-2e453a41781f800d9ba9c6da80b55276?source=copy_link
https://vuldb.com/?ctiid.341742
https://vuldb.com/?id.341742
https://vuldb.com/?submit.735695
https://www.totolink.net/

Check your stack JSON