CVE-2026-1326

2.1 lowEPSS 3.5%

Low (2.1) in totolink nr1800x firmware. EPSS 3.5% chance of exploitation in the next 30 days.

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.5% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-77
Published: 2026-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:nr1800x_firmware

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWanCfg-2e453a41781f80b390f3e1ce0d9dd5b9?source=copy_link
https://vuldb.com/?ctiid.342302
https://vuldb.com/?id.342302
https://vuldb.com/?submit.735787
https://www.totolink.net/

Check your stack JSON