CVE-2026-9543: Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-07-23
Weakness: CWE-77

Description

A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Affected products

Totolink N300RH: 6.1c.1353_B20190305

References

https://github.com/A1ester/TOTOLINK-N300RH-Command-Injection
https://vuldb.com/submit/815068
https://vuldb.com/vuln/365607
https://vuldb.com/vuln/365607/cti
https://www.totolink.net/
https://vuldb.com/submit/815068

Get alerted when CVE-2026-9543 or the next vulnerability affects your stack