CVE-2026-1155

7.4 highEPSS 0.9%

High (7.4) in totolink lr350 firmware. EPSS 0.9% chance of exploitation in the next 30 days.

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

Severity

CVSS 4.0

7.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWEs: CWE-119, CWE-120
Published: 2026-01-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:lr350_firmware

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWiFiEasyGuestCfg-2e453a41781f8034bae3d1a11066a8fb?source=copy_link
https://vuldb.com/?ctiid.341749
https://vuldb.com/?id.341749
https://vuldb.com/?submit.735718
https://www.totolink.net/

Check your stack JSON