CVE-2026-7548

Totolink NR1800X cstecgi.cgi sub_41A68C command injection

State: Published
Severity: 8.7 High
Published: May 1, 2026
Updated: May 1, 2026
Reserved: Apr 30, 2026

Description

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
NR1800XTotolink	9.1.0u.6279_B20210910Affected

References

VDB-360358 | Totolink NR1800X cstecgi.cgi sub_41A68C command injectionvdb-entrytechnical-description
VDB-360358 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #804417 | Totolink C834FR-1C NR1800X command injectionthird-party-advisory
https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.mdexploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.