Cyber Posture

CVE-2026-1327

MediumPublic PoC

Published: 22 January 2026

Published
22 January 2026
Modified
29 January 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0041 61.3th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be…

more

launched remotely. The exploit has been disclosed publicly and may be used.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation and sanitization of the 'command' argument in POST requests to /cgi-bin/cstecgi.cgi, preventing command injection by neutralizing special elements.

prevent

Mandates timely remediation of the specific command injection flaw in Totolink NR1800X firmware version 9.1.0u.6279_B20210910 through vendor patches.

detect

Generates audit records for POST requests to setTracerouteCfg and executed commands, enabling identification of exploitation attempts via log review.

Security SummaryAI

CVE-2026-1327 is a command injection vulnerability in the Totolink NR1800X router running firmware version 9.1.0u.6279_B20210910. The issue resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component. By manipulating the "command" argument in a POST request, an attacker can inject arbitrary commands, as classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-22.

A remote attacker with low privileges, such as an authenticated user on the device, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing the injection and execution of operating system commands on the router. The scope remains unchanged, meaning the attack does not propagate beyond the targeted component.

Advisories and additional details are available from sources including VulDB (ctiid.342303, id.342303, submit.735790) and a public exploit disclosure at a Notion site. The vendor's website at totolink.net provides further context, though specific patch or mitigation guidance is referenced in these locations. The exploit has been publicly disclosed and may be used in attacks.

Details

CWE(s)

Affected Products

totolink
nr1800x firmware
9.1.0u.6279_b20210910

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection vulnerability in router web interface enables exploitation of public-facing application (T1190) for arbitrary OS command execution, facilitating Unix Shell usage (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References