Vulnerability · Published May 1, 2026 · Assigned by VulDB
CVE-2026-7548Totolink NR1800X cstecgi.cgi sub_41A68C command injection
High 8.8
In plain English
A high-severity command injection in NR1800X from Totolink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.5%top 25.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-360358 | Totolink NR1800X cstecgi.cgi sub_41A68C command injection vdb-entry, technical-description
- VDB-360358 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #804417 | Totolink C834FR-1C NR1800X command injection third-party-advisory
- https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md exploit
- https://www.totolink.net/ product