Remote Command Injection in TOTOLINK NR1800X

hello@craftedsignal.io — Mon, 31 Aug 2026 03:13:32 +0000

A command injection vulnerability, tracked as CVE-2026-82597, exists in the TOTOLINK NR1800X router running firmware version 9.1.0u.6681_B20230703. The vulnerability originates within the setUssd function of the /cgi-bin/cstecgi.cgi script. An unauthenticated remote attacker can exploit this flaw by sending a crafted HTTP request with a malicious payload injected into the ussd parameter.

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the web server process on the affected router. Given the availability of public exploit code, the risk of exploitation by opportunistic actors is elevated. This vulnerability is critical for network perimeter security, as routers are common gateways. Defenders should note that this vulnerability does not require prior authentication, making it particularly dangerous for internet-facing devices.

NR1800X (9.1.0u.6681_B20230703) - CraftedSignal Threat Feed

Remote Command Injection in TOTOLINK NR1800X