CVE-2026-5030

Name of the Vulnerable Software and Affected Versions Totolink NR1800X version 9.1.0u.6279 B20210910

Description A command injection issue exists in the Telnet Service component of Totolink NR1800X. The issue is located in the NTPSyncWithHost function within the /cgi-bin/cstecgi.cgi file. Manipulation of the host time argument can lead to command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

Recommendations Totolink NR1800X version 9.1.0u.6279 B20210910: As a temporary workaround, consider disabling the Telnet Service to minimize the risk of exploitation. Avoid using the host time argument in the /cgi-bin/cstecgi.cgi file until the issue is resolved.