Volerion logoVolerion
Volerion logoVolerion

Totolink NR1800X Command Injection Vulnerability in Telnet Service

Vulnerability

A command injection vulnerability has been identified in the Totolink NR1800X router, specifically in the firmware version 9.1.0u.6279_B20210910. The issue arises in the Telnet service, within the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The vulnerability allows remote attackers to inject commands by manipulating the host_time parameter, which is received from POST requests. This exploitation could lead to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device via the Telnet service.

Added: Mar 29, 2026, 5:44 AM
Updated: Mar 29, 2026, 5:44 AM

Vulnerability Rating

Custom Algorithm
spread
2.6
impact
7.5
exploitability
9.1
remediation
0.0
relevance
4.9
threat
6.4
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.