VulnerabilityAnalyzed

CVE-2026-1149

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309.

LOW 2.1EPSS 2.82%

Does this matter?

Lower severity and a low EPSS score (2.82%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 2.82% probability · 86th percentile
CISA KEV: Not listed
Weakness: CWE-74, CWE-77
Affected: totolink/lr350 firmware
Source: cna@vuldb.com

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setDiagnosisCfg-2e453a41781f800d9ba9c6da80b55276?source=copy_linkExploit, Third Party Advisory
https://vuldb.com/?ctiid.341742Permissions Required, VDB Entry
https://vuldb.com/?id.341742Third Party Advisory, VDB Entry
https://vuldb.com/?submit.735695Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.