Volerion logoVolerion
Volerion logoVolerion

Totolink LR350 Command Injection Vulnerability in Traceroute Configuration Function

Vulnerability

A command injection vulnerability has been identified in the Totolink LR350 router, specifically in the firmware version 9.3.5u.6369_B20220309. The issue arises in the 'setTracerouteCfg' function within the file '/cgi-bin/cstecgi.cgi', part of the POST request handler. The vulnerability allows remote attackers to inject commands by manipulating the 'command' argument in a POST request.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Added: Jan 19, 2026, 11:19 AM
Updated: Jan 19, 2026, 11:19 AM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
7.5
exploitability
7.6
remediation
0.0
relevance
2.2
threat
6.4
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.