CVE-2026-7548CWE-74CWE-77

Totolink NR1800X cstecgi.cgi sub_41A68C command injection

High · published May 1, 2026

CVSS v4.0
8.7
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.02889 · 86.8th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-05-01T02:30Z
EPSS history
Timeline
  • 01 MAY 02:30Z
    Totolink NR1800X cstecgi.cgi sub_41A68C command injection
    cvelistv5