CVE-2026-1149
Published: 19 January 2026
Summary
CVE-2026-1149 is a medium-severity Injection (CWE-74) vulnerability in Totolink Lr350 Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1149 is a command injection vulnerability affecting the Totolink LR350 router on firmware version 9.3.5u.6369_B20220309. The flaw exists in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file within the POST Request Handler component, where manipulation of the "ip" argument enables command injection. Published on 2026-01-19, it is associated with CWE-74 and CWE-77.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), indicating network accessibility with low complexity and requiring low privileges but no user interaction. An authenticated remote attacker with low privileges can exploit it to achieve limited impacts on confidentiality, integrity, and availability via injected commands. A public exploit is available and might be used.
Mitigation details and advisories are documented in references including https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setDiagnosisCfg-2e453a41781f800d9ba9c6da80b55276?source=copy_link, https://vuldb.com/?ctiid.341742, https://vuldb.com/?id.341742, https://vuldb.com/?submit.735695, and the vendor site https://www.totolink.net/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3226
Vulnerability details
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely.…
more
The exploit is publicly available and might be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web CGI in router's public-facing interface enables T1190 (Exploit Public-Facing Application) and facilitates T1059.004 (Unix Shell) execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation of the untrusted 'ip' argument in the setDiagnosisCfg POST request handler to block malicious command sequences.
Remediates the specific command injection flaw in cstecgi.cgi by applying vendor firmware patches or updates.
Enforces least privilege on low-privilege accounts accessing the vulnerable function, limiting the impact of any successfully injected commands.