CVE-2026-82555CWE-330

CVE-2026-82555

Low · published August 30, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00664 · 51.1th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2026-08-30T22:17Z
References (7)
https://github.com/b1uerry/cves/blob/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token/poc.py · [email protected]https://github.com/b1uerry/cves/tree/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token · [email protected]https://vuldb.com/cve/CVE-2026-82555 · [email protected]https://vuldb.com/submit/891698 · [email protected]https://vuldb.com/vuln/397071 · [email protected]https://vuldb.com/vuln/397071/cti · [email protected]https://www.totolink.net/ · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 17:30Z
    TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
    cvelistv5