A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
References
| Link | Resource |
|---|---|
| https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9?source=copy_link | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.342304 | Permissions Required VDB Entry |
| https://vuldb.com/?id.342304 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.735792 | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
29 Jan 2026, 17:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Totolink nr1800x Firmware
Totolink nr1800x Totolink |
|
| CPE | cpe:2.3:h:totolink:nr1800x:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6279_b20210910:*:*:*:*:*:*:* |
|
| References | () https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9?source=copy_link - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.342304 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.342304 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.735792 - Third Party Advisory, VDB Entry | |
| References | () https://www.totolink.net/ - Product |
22 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-22 15:16
Updated : 2026-01-29 17:47
NVD link : CVE-2026-1328
Mitre link : CVE-2026-1328
CVE.ORG link : CVE-2026-1328
JSON object : View
Products Affected
totolink
- nr1800x
- nr1800x_firmware