Cyber Posture

CVE-2026-5030

MediumPublic PoC

Published: 29 March 2026

Published
29 March 2026
Modified
30 March 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0192 83.5th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely.…

more

The exploit has been disclosed to the public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by requiring validation of the untrusted host_time input to the NTPSyncWithHost function in cstecgi.cgi.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific command injection flaw in the Totolink NR1800X firmware to eliminate the vulnerability.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables detection of the command injection vulnerability through regular vulnerability scanning of the affected router firmware.

Security SummaryAI

CVE-2026-5030 is a command injection vulnerability affecting the Totolink NR1800X router on firmware version 9.1.0u.6279_B20210910. The issue resides in the NTPSyncWithHost function of the /cgi-bin/cstecgi.cgi file within the Telnet Service component, where manipulation of the host_time argument enables command injection. Published on 2026-03-29, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through injected commands.

Advisories and additional details, including public exploit disclosure, are available via references such as VulDB entries (vuldb.com/vuln/353952), a proof-of-concept at a Notion site, and the vendor site at www.totolink.net. The exploit has been disclosed to the public and may be used.

Details

CWE(s)
CWE-74CWE-77

Affected Products

totolink
nr1800x firmware
9.1.0u.6279_b20210910

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection in router CGI enables exploitation of public-facing application (T1190) and execution of commands via network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References