CVE-2026-1150: Totolink LR350 Firmware RCE Vulnerability

CVE-2026-1150 Overview

CVE-2026-1150 is a command injection vulnerability in the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The flaw resides in the setTracerouteCfg function within /cgi-bin/cstecgi.cgi, part of the POST request handler. Attackers can manipulate the command argument to inject arbitrary operating system commands. The issue is exploitable remotely, and a public exploit has been disclosed, increasing the risk of opportunistic abuse against exposed devices. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject operating system commands through the setTracerouteCfg endpoint of affected Totolink LR350 routers, with public exploit code available.

Affected Products

Totolink LR350 (hardware)
Totolink LR350 Firmware 9.3.5u.6369_B20220309
Component: /cgi-bin/cstecgi.cgi POST request handler (setTracerouteCfg function)

Discovery Timeline

2026-01-19 - CVE-2026-1150 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-1150

Vulnerability Analysis

The Totolink LR350 exposes a web management interface that processes administrative actions via /cgi-bin/cstecgi.cgi. The setTracerouteCfg handler accepts a command parameter intended to configure traceroute target parameters. The handler passes the supplied value into an underlying shell execution context without proper neutralization of shell metacharacters. This allows an attacker to append arbitrary commands using separators such as ;, &&, or backticks.

Because the CGI binary on most Totolink consumer router builds runs with elevated privileges, successfully injected commands typically execute in the context of the device's root or admin user. The result is full command execution on the embedded Linux system that backs the router.

Root Cause

The root cause is improper neutralization of user-controlled input passed to a downstream shell interpreter [CWE-74]. The setTracerouteCfg function does not validate, escape, or restrict the character set of the command argument before constructing a system call. Any shell metacharacter supplied in the POST body is interpreted by the underlying shell.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the router's web interface. An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setTracerouteCfg action with a malicious command payload. The injected commands execute on the device immediately. Devices exposed to the internet, or reachable through a compromised LAN host, are at greatest risk. Public exploit details have been published, lowering the barrier for weaponization.

No verified proof-of-concept code is included here. Refer to the TOTOLINK LR350 setTracerouteCfg technical write-up and the VulDB entry #341743 for additional technical detail.

Detection Methods for CVE-2026-1150

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setTracerouteCfg topic and a command parameter that includes shell metacharacters such as ;, |, &, backticks, or $().
Outbound connections from the router to unexpected hosts shortly after administrative HTTP traffic, indicating possible reverse shell or downloader activity.
New or modified processes on the device such as wget, curl, tftp, nc, or shell interpreters invoked from the CGI process tree.

Detection Strategies

Inspect web server and reverse-proxy logs for POST requests to cstecgi.cgi that reference setTracerouteCfg together with non-alphanumeric characters in the command field.
Deploy network intrusion detection signatures that flag shell metacharacters inside the body of requests targeting Totolink CGI endpoints.
Correlate router management traffic with subsequent anomalous DNS lookups or outbound connections to non-ISP infrastructure.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log platform and alert on requests matching the vulnerable endpoint pattern.
Monitor for unauthorized administrative logins to the router and changes to traceroute or diagnostic configuration values.
Track firmware version drift and unexpected reboots, which can indicate exploitation or post-exploitation persistence attempts.

How to Mitigate CVE-2026-1150

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal management VLANs only and disable WAN-side administration.
Rotate all administrative credentials on affected LR350 devices, since exploitation requires low-privilege authenticated access.
Audit recent traffic to /cgi-bin/cstecgi.cgi for suspicious setTracerouteCfg requests and isolate any device showing signs of compromise.

Patch Information

At the time of publication, no vendor advisory or patched firmware build addressing CVE-2026-1150 has been published by Totolink. Check the TOTOLINK official website for firmware updates and apply the next stable release as soon as it becomes available. Until a patch is released, treat affected LR350 devices as exposed and apply compensating controls.

Workarounds

Disable remote (WAN) management on the LR350 and require VPN access for any administrative interaction with the device.
Place affected routers behind a network firewall that blocks inbound HTTP and HTTPS connections from untrusted networks to the management interface.
Replace end-of-support or unpatched LR350 units with currently supported hardware if a vendor fix is not released in a timely manner.

bash

# Configuration example: block external access to the router management UI
# Example iptables rule applied on an upstream firewall protecting 192.0.2.10 (LR350)
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80  -i wan0 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -i wan0 -j DROP

# Restrict management access to a single jump host on the LAN
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80  -s 10.10.10.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80  -j DROP