CVE-2026-1150: Totolink LR350 RCE Vulnerability

CVE-2026-1150 Overview

A command injection vulnerability has been discovered in the TOTOLINK LR350 router firmware version 9.3.5u.6369_B20220309. The vulnerability exists in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi POST Request Handler component. Attackers can exploit this flaw by manipulating the command argument, allowing arbitrary command injection on the target device. The attack can be launched remotely over the network, and exploit code has been publicly released, increasing the risk of active exploitation.

Critical Impact

Remote attackers with low privileges can inject and execute arbitrary commands on vulnerable TOTOLINK LR350 routers, potentially leading to complete device compromise, network pivoting, and persistent access to the affected network infrastructure.

Affected Products

• TOTOLINK LR350 Firmware Version 9.3.5u.6369_B20220309
• TOTOLINK LR350 devices with vulnerable /cgi-bin/cstecgi.cgi component
• Network environments utilizing affected TOTOLINK router firmware

Discovery Timeline

• January 19, 2026 - CVE-2026-1150 published to NVD
• January 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1150

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly known as Injection). The flaw resides in the web management interface of the TOTOLINK LR350 router, specifically within the traceroute configuration functionality.

The setTracerouteCfg function fails to properly sanitize user-supplied input in the command parameter before passing it to system-level execution routines. This lack of input validation allows attackers to inject shell metacharacters and arbitrary commands that are subsequently executed with the privileges of the web server process, typically running as root on embedded devices.

The network-based attack vector enables remote exploitation without requiring physical access to the device. An authenticated attacker with low-level privileges can craft malicious POST requests to the vulnerable CGI endpoint, achieving command execution on the underlying operating system.

Root Cause

The root cause stems from inadequate input validation and sanitization in the setTracerouteCfg function. The command argument is directly incorporated into system calls without proper escaping or filtering of shell metacharacters such as semicolons, pipes, backticks, or command substitution sequences. This allows specially crafted input to break out of the intended command context and execute additional attacker-controlled commands.

Attack Vector

The vulnerability is exploited through the network by sending specially crafted HTTP POST requests to the /cgi-bin/cstecgi.cgi endpoint. The attack requires low-level authentication but no user interaction.

An attacker would target the setTracerouteCfg function by manipulating the command parameter in the POST request body. By injecting shell metacharacters followed by malicious commands, the attacker can execute arbitrary code on the router. Common exploitation techniques include command chaining using semicolons (;), command substitution using backticks or $() syntax, and pipe operators (|) to redirect output to attacker-controlled commands.

For detailed technical analysis and proof-of-concept information, refer to the Notion Configuration Guide and VulDB CVE Analysis.

Detection Methods for CVE-2026-1150

Indicators of Compromise

• Unusual HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters in the command parameter
• Unexpected outbound network connections from the TOTOLINK router to external IP addresses
• New or modified files in the router's filesystem, particularly in /tmp or writable directories
• Spawned processes from the web server that are not part of normal router operations

Detection Strategies

• Implement network-level monitoring for HTTP POST requests targeting /cgi-bin/cstecgi.cgi with suspicious payloads
• Deploy intrusion detection signatures to identify command injection patterns such as semicolons, backticks, or $() sequences in web traffic to router management interfaces
• Monitor router logs for authentication events followed by traceroute configuration changes
• Use SentinelOne Singularity to detect anomalous process execution and network behaviors on monitored network segments

Monitoring Recommendations

• Enable comprehensive logging on the TOTOLINK router management interface if available
• Implement network segmentation to isolate IoT and router management traffic from production networks
• Deploy network monitoring solutions to capture and analyze traffic to and from router management interfaces
• Regularly review router configurations for unauthorized changes or persistence mechanisms

How to Mitigate CVE-2026-1150

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only
• Implement firewall rules to block external access to /cgi-bin/cstecgi.cgi endpoints
• Place the router management interface on a separate VLAN accessible only from secure management workstations
• Monitor for firmware updates from TOTOLINK and apply patches as soon as they become available

Patch Information

At the time of publication, no official patch has been released by TOTOLINK for this vulnerability. Organizations should monitor the TOTOLINK Official Website for security updates and firmware releases addressing CVE-2026-1150. Additional vulnerability tracking information is available at VulDB #341743.

Workarounds

• Disable remote management access to the router if not required for operations
• Implement network-level access controls using firewall rules to restrict management interface access to specific administrator IP addresses
• Consider replacing the affected TOTOLINK LR350 device with alternative router hardware until a patch is available
• Deploy a web application firewall (WAF) in front of the router management interface to filter malicious requests

# Example firewall rule to restrict management access (adapt to your firewall)
# Block external access to CGI endpoints
iptables -A INPUT -p tcp --dport 80 -d <router_ip> -s ! <admin_network> -j DROP
iptables -A INPUT -p tcp --dport 443 -d <router_ip> -s ! <admin_network> -j DROP