CVE-2026-1150
Published: 19 January 2026
Description
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched…
more
remotely. The exploit has been released to the public and may be used for attacks.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation and error handling of the manipulated 'command' argument in the vulnerable setTracerouteCfg POST request handler.
Requires timely identification, reporting, and correction of the software flaw in firmware version 9.3.5u.6369_B20220309 through patching or updates.
Enables vulnerability scanning to identify the publicly disclosed command injection flaw (with PoC exploit) in the Totolink LR350 router for subsequent remediation.
Security SummaryAI
CVE-2026-1150 is a command injection vulnerability (CWE-74, CWE-77) affecting the Totolink LR350 router on firmware version 9.3.5u.6369_B20220309. The flaw resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component. An attacker can exploit it by manipulating the 'command' argument in a remote POST request, leading to arbitrary command execution on the device.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It can be exploited remotely by an attacker with low privileges, requiring no user interaction and no change in scope. Successful exploitation allows limited impacts to confidentiality, integrity, and availability, such as executing injected commands on the router.
Advisories and additional details are available from VulDB entries (https://vuldb.com/?ctiid.341743, https://vuldb.com/?id.341743, https://vuldb.com/?submit.735696) and the vendor site (https://www.totolink.net/). A proof-of-concept exploit has been publicly released, as shared on https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setTracerouteCfg-2e453a41781f803494e3e4161a393487?source=copy_link, increasing the risk of real-world attacks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in a public-facing web CGI interface on a router, directly enabling exploitation of public-facing applications (T1190) and arbitrary command execution on a network device CLI (T1059.008).