Cyber Posture

CVE-2026-7548

High

Published: 01 May 2026

Published
01 May 2026
Modified
01 May 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0154 81.5th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is…

more

now public and may be used.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates command injection by validating and sanitizing the setUssd argument in the sub_41A68C function of cstecgi.cgi to block arbitrary command execution.

SI-2 Flaw Remediation good match
prevent

Addresses the specific flaw in Totolink NR1800X firmware version 9.1.0u.6279_B20210910 through timely identification, reporting, and patching to remediate the command injection vulnerability.

SI-9 Information Input Restrictions good match
prevent

Restricts the setUssd input parameter to only approved types and formats, preventing malicious command strings from being processed remotely.

Security SummaryAI

CVE-2026-7548 is a command injection vulnerability affecting the Totolink NR1800X router on firmware version 9.1.0u.6279_B20210910. The issue lies in the sub_41A68C function of the /cgi-bin/cstecgi.cgi script, where manipulation of the setUssd argument enables arbitrary command injection. Published on 2026-05-01, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability is exploitable remotely by attackers possessing low privileges, such as authenticated users with basic access to the device. Exploitation requires network access with low attack complexity and no user interaction. Successful attacks allow arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full device compromise.

References include a GitHub repository with a public proof-of-concept exploit detailing the Totolink NR1800X command injection, VulDB entries (vuln/360358 and related CTI/submit pages) confirming the remote command injection, and the Totolink vendor website. No specific patches or mitigations are outlined in the provided advisories.

The exploit is public and available for use, heightening the risk of active exploitation against unpatched devices.

Details

CWE(s)
CWE-74CWE-77

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Command injection via web CGI on router enables exploitation of public-facing application (T1190) and arbitrary command execution on network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References