CVE-2026-1149: Totolink LR350 RCE Vulnerability

CVE-2026-1149 Overview

A command injection vulnerability has been identified in the Totolink LR350 router firmware version 9.3.5u.6369_B20220309. This security flaw affects the setDiagnosisCfg function within the /cgi-bin/cstecgi.cgi POST Request Handler component. Attackers can exploit this vulnerability by manipulating the ip argument to inject and execute arbitrary system commands on the affected device.

Critical Impact

Remote attackers with low-level privileges can execute arbitrary commands on affected Totolink LR350 routers, potentially leading to complete device compromise, network infiltration, and persistent access to the local network environment.

Affected Products

• Totolink LR350 firmware version 9.3.5u.6369_B20220309
• Totolink LR350 router devices running vulnerable firmware

Discovery Timeline

• 2026-01-19 - CVE CVE-2026-1149 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2026-1149

Vulnerability Analysis

This command injection vulnerability (CWE-74) exists in the diagnostic configuration functionality of the Totolink LR350 router. The setDiagnosisCfg function fails to properly sanitize user-supplied input in the ip parameter before passing it to system-level command execution functions. This allows an authenticated attacker with network access to inject shell metacharacters and execute arbitrary commands with the privileges of the web server process, typically root on embedded devices like this router.

The vulnerability is accessible via the network without user interaction, though it requires low-level authentication. The publicly available exploit increases the practical risk of active exploitation in the wild.

Root Cause

The root cause of this vulnerability stems from insufficient input validation in the setDiagnosisCfg function. The ip argument is incorporated directly into a system command (likely a diagnostic ping or traceroute operation) without proper sanitization or escaping of shell metacharacters. This classic injection pattern allows attackers to break out of the intended command context and append malicious commands using shell operators such as ;, |, &&, or backticks.

Attack Vector

The attack is conducted remotely over the network by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi. An attacker with valid credentials (even low-privilege access) can target the setDiagnosisCfg endpoint and inject commands through the ip parameter. The malicious payload is then executed by the underlying system shell, allowing the attacker to perform unauthorized actions such as downloading malware, establishing reverse shells, modifying device configuration, or pivoting to other network resources.

Since this is a network-accessible vulnerability on a router device, exploitation can potentially be performed from both the LAN and WAN sides depending on the device configuration. The technical writeup is available at the Notion Resource on TOTOLINK for additional details.

Detection Methods for CVE-2026-1149

Indicators of Compromise

• Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the ip parameter
• Unusual outbound connections from the router to unknown external IP addresses or command-and-control servers
• Modified router configuration files or unauthorized user accounts on the device
• Unexpected processes running on the router or abnormal CPU/memory utilization

Detection Strategies

• Monitor web server logs on Totolink devices for POST requests to cstecgi.cgi containing suspicious characters such as ;, |, &&, backticks, or $() in parameter values
• Implement network intrusion detection rules to identify command injection patterns in HTTP traffic destined for router management interfaces
• Deploy behavioral analysis to detect anomalous network activity originating from router devices
• Regularly audit router configurations for unauthorized changes or new administrative accounts

Monitoring Recommendations

• Enable logging on the router management interface and forward logs to a centralized SIEM for analysis
• Monitor network traffic for connections from router management interfaces to unusual destinations
• Set up alerts for multiple failed authentication attempts followed by successful access to the diagnostic functions
• Periodically verify firmware integrity using known-good hashes when available

How to Mitigate CVE-2026-1149

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Disable WAN-side management access if not explicitly required
• Implement strong, unique credentials for all router administrative accounts
• Segment the network to limit the potential impact of router compromise
• Monitor for firmware updates from Totolink and apply patches when available

Patch Information

At the time of publication, no official patch has been confirmed from Totolink. Users should regularly check the TOTOLINK Official Website for firmware updates addressing this vulnerability. Additional vulnerability details are tracked at VulDB ID #341742.

Workarounds

• Implement access control lists (ACLs) to restrict management interface access to specific trusted IP addresses or subnets
• Disable remote management features if they are not required for operational purposes
• Deploy a firewall or security gateway in front of the router to filter malicious requests containing command injection patterns
• Consider replacing affected devices with alternatives from vendors with better security update practices if no patch is forthcoming

# Example: Restrict management access via firewall rules (external firewall)
# Block external access to router management ports
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP

# Allow management only from trusted admin subnet
iptables -I FORWARD -s 192.168.1.0/24 -d <ROUTER_IP> -p tcp --dport 80 -j ACCEPT