Volerion logoVolerion
Volerion logoVolerion

Totolink LR350 Command Injection Vulnerability in setDiagnosisCfg Function

Vulnerability

A command injection vulnerability has been identified in the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The issue arises in the POST request handler, specifically within the setDiagnosisCfg function of the cgi-bin/cstecgi.cgi file. The vulnerability allows remote attackers to inject commands by manipulating the ip parameter in the POST request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Added: Jan 19, 2026, 10:19 AM
Updated: Jan 19, 2026, 10:19 AM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
7.5
exploitability
7.6
remediation
0.0
relevance
2.3
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.