CVE-2026-1158
Published: 19 January 2026
Summary
CVE-2026-1158 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink Lr350 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the buffer overflow vulnerability by requiring identification, reporting, and timely remediation through firmware patching for the affected Totolink LR350 setWizardCfg function.
Prevents exploitation of the buffer overflow by enforcing validation of the 'ssid' argument in POST requests to /cgi-bin/cstecgi.cgi, addressing CWE-119 and CWE-120 root causes.
Implements memory protections such as stack canaries, ASLR, and DEP to minimize successful arbitrary code execution from the buffer overflow in the POST request handler.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router's web CGI (/cgi-bin/cstecgi.cgi) enables remote exploitation by authenticated low-priv users for RCE, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
NVD Description
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can…
more
be initiated remotely. The exploit has been released to the public and may be used for attacks.
Deeper analysisAI
CVE-2026-1158 is a buffer overflow vulnerability affecting the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The flaw resides in the setWizardCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component. By manipulating the 'ssid' argument in a POST request, an attacker can trigger the buffer overflow, as documented with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-19.
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user on the device. Exploitation requires network access and low attack complexity with no user interaction needed. Successful exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data theft, or full device compromise. A public exploit has been released, increasing the risk of real-world attacks.
Advisories and details are available through references including VulDB entries (vuldb.com/?ctiid.341752, vuldb.com/?id.341752, vuldb.com/?submit.735728), a technical write-up at lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWizardCfg-2e453a41781f80ce89cfc1d25049e279, and the vendor site at totolink.net. No specific patch or mitigation details are outlined in the core vulnerability data, but practitioners should consult these sources for firmware updates or workarounds.
Notable context includes the public availability of an exploit, heightening the urgency for affected devices to be patched or isolated. No AI/ML relevance is indicated.
Details
- CWE(s)