CVE-2026-1150
Published: 19 January 2026
Summary
CVE-2026-1150 is a medium-severity Injection (CWE-74) vulnerability in Totolink Lr350 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation and error handling of the manipulated 'command' argument in the vulnerable setTracerouteCfg POST request handler.
Requires timely identification, reporting, and correction of the software flaw in firmware version 9.3.5u.6369_B20220309 through patching or updates.
Enables vulnerability scanning to identify the publicly disclosed command injection flaw (with PoC exploit) in the Totolink LR350 router for subsequent remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a command injection in a public-facing web CGI interface on a router, directly enabling exploitation of public-facing applications (T1190) and arbitrary command execution on a network device CLI (T1059.008).
NVD Description
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched…
more
remotely. The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-1150 is a command injection vulnerability (CWE-74, CWE-77) affecting the Totolink LR350 router on firmware version 9.3.5u.6369_B20220309. The flaw resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component. An attacker can exploit it by manipulating the 'command' argument in a remote POST request, leading to arbitrary command execution on the device.
The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). It can be exploited remotely by an attacker with low privileges, requiring no user interaction and no change in scope. Successful exploitation allows limited impacts to confidentiality, integrity, and availability, such as executing injected commands on the router.
Advisories and additional details are available from VulDB entries (https://vuldb.com/?ctiid.341743, https://vuldb.com/?id.341743, https://vuldb.com/?submit.735696) and the vendor site (https://www.totolink.net/). A proof-of-concept exploit has been publicly released, as shared on https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setTracerouteCfg-2e453a41781f803494e3e4161a393487?source=copy_link, increasing the risk of real-world attacks.
Details
- CWE(s)