CVE-2026-9543

8.9 highEPSS 2.1%

High (8.9). EPSS 2.1% chance of exploitation in the next 30 days.

A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

8.9 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-05-26
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/A1ester/TOTOLINK-N300RH-Command-Injection
https://vuldb.com/submit/815068
https://vuldb.com/vuln/365607
https://vuldb.com/vuln/365607/cti
https://www.totolink.net/

Check your stack JSON