CVE-2026-1157

CVE-2026-1157 is a buffer overflow vulnerability affecting the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The issue resides in the setWiFiEasyCfg function within the /cgi-bin/cstecgi.cgi file, where improper handling of the ssid argument triggers the overflow. Associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability enables remote exploitation over the network with low complexity and no user interaction required. Attackers need low privileges (PR:L), such as those of an authenticated user, to manipulate the ssid argument and trigger the buffer overflow. Successful exploitation could result in high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.

Advisories and additional details are available through referenced sources, including a technical write-up at a Notion site detailing the exploit, multiple VulDB entries (ctiid.341751, id.341751, submit.735726), and the official Totolink website. Security practitioners should consult these for patch availability, firmware updates, or workarounds, as the exploit is publicly available and may be actively used.

The public availability of the exploit underscores the need for immediate firmware updates on affected Totolink LR350 devices.