CVE-2026-1158 Overview
CVE-2026-1158 is a buffer overflow vulnerability in the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The flaw resides in the setWizardCfg function within /cgi-bin/cstecgi.cgi, a component handling POST request processing. Attackers can trigger the overflow by manipulating the ssid argument in a crafted HTTP POST request. The vulnerability is exploitable remotely and a public exploit has been released, increasing the risk of opportunistic attacks against exposed devices. The weakness is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer.
Critical Impact
Remote attackers with low privileges can corrupt memory on affected Totolink LR350 routers, potentially leading to denial of service or arbitrary code execution on the device.
Affected Products
- Totolink LR350 router (hardware)
- Totolink LR350 firmware version 9.3.5u.6369_B20220309
- Deployments exposing the /cgi-bin/cstecgi.cgi endpoint to untrusted networks
Discovery Timeline
- 2026-01-19 - CVE-2026-1158 published to NVD
- 2026-01-29 - Last updated in NVD database
Technical Details for CVE-2026-1158
Vulnerability Analysis
The vulnerability is a stack or heap-based buffer overflow triggered through the web management interface of the Totolink LR350. The setWizardCfg handler in /cgi-bin/cstecgi.cgi processes setup wizard parameters submitted by authenticated users. When the handler receives the ssid parameter, it copies attacker-controlled input into a fixed-size buffer without enforcing length validation. Oversized input overwrites adjacent memory, corrupting program state on the router. Successful exploitation can crash the HTTP daemon or, depending on memory layout, redirect execution flow.
Root Cause
The root cause is missing bounds checking on the ssid argument passed to setWizardCfg. The function relies on unsafe string-copy operations that trust the length of user-supplied input. This pattern matches [CWE-119], improper restriction of operations within the bounds of a memory buffer, common across consumer router firmware built on stripped-down embedded Linux stacks.
Attack Vector
The attack is delivered over the network via a POST request to /cgi-bin/cstecgi.cgi. The attacker must hold at least low-level credentials to reach the wizard configuration endpoint. No user interaction is required beyond the attacker's own request. Devices exposing the management interface to the WAN or to untrusted LAN segments face the highest risk. Public exploit code lowers the barrier for mass scanning and exploitation.
No verified proof-of-concept code is published in this advisory. Technical details are referenced in the Notion configuration guide and the VulDB entry #341752.
Detection Methods for CVE-2026-1158
Indicators of Compromise
- POST requests to /cgi-bin/cstecgi.cgi containing abnormally long ssid values, particularly above typical 32-byte SSID length limits.
- Unexpected restarts or crashes of the router's HTTP daemon shortly after receiving wizard configuration requests.
- Outbound connections from the router to unfamiliar hosts after a wizard configuration request, which may indicate post-exploitation activity.
Detection Strategies
- Inspect HTTP request bodies on traffic destined for Totolink LR350 management interfaces and flag ssid fields exceeding standard length boundaries.
- Correlate authentication events with setWizardCfg invocations to identify low-privileged accounts triggering wizard configuration repeatedly.
- Deploy network signatures targeting cstecgi.cgi POSTs with oversized payloads addressed to the router management port.
Monitoring Recommendations
- Forward router syslog and HTTP access logs to a central analytics platform such as Singularity Data Lake for retention and search across long time horizons.
- Alert on repeated 5xx responses or service restarts from the embedded HTTP server, which often precede successful overflow exploitation.
- Monitor for new administrative sessions or configuration changes originating from previously unseen source addresses.
How to Mitigate CVE-2026-1158
Immediate Actions Required
- Restrict access to the router's management interface to trusted internal hosts and disable WAN-side administration immediately.
- Rotate all administrative credentials on affected Totolink LR350 devices to limit abuse of the low-privilege precondition.
- Audit device configurations for unauthorized changes, particularly to wizard, DNS, and firewall settings.
Patch Information
No vendor patch is listed in the published advisory data at the time of writing. Check the TOTOLINK official website for firmware updates superseding 9.3.5u.6369_B20220309. Apply any released firmware update for the LR350 product line and validate the version after installation.
Workarounds
- Place the LR350 management interface behind a VPN or jump host so it is not reachable from untrusted networks.
- Use upstream firewall rules to drop inbound traffic to the router's HTTP and HTTPS management ports from outside the management VLAN.
- Disable the setup wizard functionality after initial provisioning if the firmware permits, removing the vulnerable code path from routine access.
- Replace end-of-support or unpatched LR350 units with currently maintained hardware where vendor fixes are not forthcoming.
# Example: restrict management access using an upstream firewall (iptables)
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
