Cyber Posture

CVE-2026-1149

MediumPublic PoC

Published: 19 January 2026

Published
19 January 2026
Modified
29 January 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0160 81.8th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely.…

more

The exploit is publicly available and might be used.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents command injection by requiring validation of the untrusted 'ip' argument in the setDiagnosisCfg POST request handler to block malicious command sequences.

prevent

Remediates the specific command injection flaw in cstecgi.cgi by applying vendor firmware patches or updates.

prevent

Enforces least privilege on low-privilege accounts accessing the vulnerable function, limiting the impact of any successfully injected commands.

Security SummaryAI

CVE-2026-1149 is a command injection vulnerability affecting the Totolink LR350 router on firmware version 9.3.5u.6369_B20220309. The flaw exists in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the POST Request Handler component, where manipulation of the "ip" argument enables command injection. Published on 2026-01-19, it is associated with CWE-74 and CWE-77.

The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network accessibility with low complexity and requiring low privileges but no user interaction. An authenticated remote attacker with low privileges can exploit it to achieve limited impacts on confidentiality, integrity, and availability via injected commands. A public exploit is available and might be used.

Mitigation details and advisories are documented in references including https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setDiagnosisCfg-2e453a41781f800d9ba9c6da80b55276?source=copy_link, https://vuldb.com/?ctiid.341742, https://vuldb.com/?id.341742, https://vuldb.com/?submit.735695, and the vendor site https://www.totolink.net/.

Details

CWE(s)

Affected Products

totolink
lr350 firmware
9.3.5u.6369_b20220309

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection via web CGI in router's public-facing interface enables T1190 (Exploit Public-Facing Application) and facilitates T1059.004 (Unix Shell) execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References