Volerion logoVolerion
Volerion logoVolerion

Totolink NR1800X Command Injection Vulnerability in setWanCfg Function

Vulnerability

A command injection vulnerability has been identified in the Totolink NR1800X router, specifically in the firmware version 9.1.0u.6279_B20210910. The issue arises in the POST request handler, within the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The vulnerability allows remote attackers to manipulate the Hostname parameter, leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Added: Jan 22, 2026, 3:24 PM
Updated: Jan 22, 2026, 3:24 PM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
10.0
exploitability
9.1
remediation
0.0
relevance
2.3
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.