CVE-2026-9543: Totolink N300RH RCE Vulnerability

CVE-2026-9543 Overview

CVE-2026-9543 is an operating system command injection vulnerability in the TOTOLINK N300RH router running firmware version 6.1c.1353_B20190305. The flaw resides in the setPasswordCfg function inside /cgi-bin/cstecgi.cgi, part of the Web Management Interface. Attackers can manipulate the admpass argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely without authentication or user interaction, and a public proof-of-concept has been disclosed [CWE-77].

Critical Impact
Unauthenticated remote attackers can execute arbitrary operating system commands on affected TOTOLINK N300RH devices, leading to full router compromise.

Affected Products

TOTOLINK N300RH router
Firmware version 6.1c.1353_B20190305
Web Management Interface component (/cgi-bin/cstecgi.cgi)

Discovery Timeline

2026-05-26 - CVE-2026-9543 published to NVD
2026-05-26 - Last updated in NVD database
Public disclosure - Proof-of-concept released on GitHub Command Injection PoC

Technical Details for CVE-2026-9543

Vulnerability Analysis

The TOTOLINK N300RH exposes a Common Gateway Interface (CGI) endpoint at /cgi-bin/cstecgi.cgi that handles administrative actions through the Web Management Interface. The setPasswordCfg handler accepts an admpass parameter intended to set the administrator password. Instead of treating the value as data, the firmware passes it into an operating system shell context. Attackers can append shell metacharacters to the parameter and execute arbitrary commands with the privileges of the web server process, which on consumer routers typically runs as root.

The vulnerability falls under [CWE-77] — Improper Neutralization of Special Elements used in a Command. The EPSS (Exploit Prediction Scoring System) probability is 0.203% with a percentile of 42.245.

Root Cause

The root cause is missing input validation and unsafe shell invocation inside the setPasswordCfg function. The admpass argument is concatenated into a shell command without sanitization, escaping, or use of a safe execution API. Any shell metacharacter — such as a semicolon, backtick, or pipe — terminates the intended command and starts an attacker-controlled one.

Attack Vector

The attack is launched over the network against the router's Web Management Interface. The attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setPasswordCfg action with a malicious admpass value. No authentication or user interaction is required. Successful exploitation yields arbitrary command execution, enabling persistence, traffic interception, lateral movement into the LAN, and recruitment into botnets.

A working proof-of-concept is available in the GitHub Command Injection PoC repository, and additional technical context is published at VulDB #365607.

Detection Methods for CVE-2026-9543

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, &, backticks, $()) in the admpass parameter.
Unexpected outbound connections originating from the router to unknown IP addresses or download servers.
New or modified processes on the router not associated with stock firmware, such as shells, wget, tftp, or busybox invocations spawned from the web server.
Unauthorized administrator password changes or new credentials in router configuration.

Detection Strategies

Inspect HTTP request bodies destined for /cgi-bin/cstecgi.cgi and alert on non-alphanumeric characters within the admpass field.
Deploy network intrusion detection signatures that match setPasswordCfg requests carrying shell payload patterns.
Correlate router-originated outbound traffic with known malicious infrastructure and botnet command-and-control feeds.

Monitoring Recommendations

Log all administrative access to TOTOLINK N300RH devices and forward syslog data to a centralized analytics platform.
Baseline normal management interface usage and alert on requests from non-administrator source IPs.
Monitor DNS queries from the router segment for anomalous lookups associated with malware staging.

How to Mitigate CVE-2026-9543

Immediate Actions Required

Restrict access to the router's Web Management Interface to trusted internal addresses and disable WAN-side administration immediately.
Place affected TOTOLINK N300RH devices behind a firewall and block inbound traffic to TCP ports 80 and 443 from untrusted networks.
Audit the device for signs of compromise, including unauthorized accounts, modified firmware, and unexpected outbound connections.
Plan replacement or decommissioning if no vendor patch is available, given the firmware's age (B20190305).

Patch Information

No vendor patch has been published at the time of disclosure. Check the TOTOLINK Official Website for firmware updates addressing the setPasswordCfg command injection. Until a fix is released, treat affected devices as exposed and apply network-layer compensating controls.

Workarounds

Disable remote (WAN) management on the router and restrict the admin interface to a dedicated management VLAN.
Enforce strong network segmentation so that compromised consumer-grade routers cannot reach sensitive internal assets.
Replace end-of-life TOTOLINK N300RH units with actively supported hardware where vendor patching is not feasible.

bash

# Configuration example: block inbound access to the router admin interface
iptables -A INPUT -p tcp --dport 80 -i wan0 -j DROP
iptables -A INPUT -p tcp --dport 443 -i wan0 -j DROP
# Restrict LAN-side admin access to a single management host
iptables -A INPUT -p tcp --dport 80 ! -s 192.0.2.10 -j DROP