CVE-2026-1326 MEDIUM

CVE-2026-1326: Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection

Vendor Totolink
Product NR1800X
Weakness CWE-77
Published January 22, 2026
Last update February 23, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Key dates

02Disclosure timeline

January 22, 2026 CVE published
February 23, 2026 Record updated