CVE-2026-1149
Published: 19 January 2026
Description
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely.…
more
The exploit is publicly available and might be used.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the untrusted 'ip' argument in the setDiagnosisCfg POST request handler to block malicious command sequences.
Remediates the specific command injection flaw in cstecgi.cgi by applying vendor firmware patches or updates.
Enforces least privilege on low-privilege accounts accessing the vulnerable function, limiting the impact of any successfully injected commands.
Security SummaryAI
CVE-2026-1149 is a command injection vulnerability affecting the Totolink LR350 router on firmware version 9.3.5u.6369_B20220309. The flaw exists in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the POST Request Handler component, where manipulation of the "ip" argument enables command injection. Published on 2026-01-19, it is associated with CWE-74 and CWE-77.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network accessibility with low complexity and requiring low privileges but no user interaction. An authenticated remote attacker with low privileges can exploit it to achieve limited impacts on confidentiality, integrity, and availability via injected commands. A public exploit is available and might be used.
Mitigation details and advisories are documented in references including https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setDiagnosisCfg-2e453a41781f800d9ba9c6da80b55276?source=copy_link, https://vuldb.com/?ctiid.341742, https://vuldb.com/?id.341742, https://vuldb.com/?submit.735695, and the vendor site https://www.totolink.net/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web CGI in router's public-facing interface enables T1190 (Exploit Public-Facing Application) and facilitates T1059.004 (Unix Shell) execution.