CVE-2026-1327
Published: 22 January 2026
Summary
CVE-2026-1327 is a medium-severity Injection (CWE-74) vulnerability in Totolink Nr1800X Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AU-12 (Audit Record Generation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of the 'command' argument in POST requests to /cgi-bin/cstecgi.cgi, preventing command injection by neutralizing special elements.
Mandates timely remediation of the specific command injection flaw in Totolink NR1800X firmware version 9.1.0u.6279_B20210910 through vendor patches.
Generates audit records for POST requests to setTracerouteCfg and executed commands, enabling identification of exploitation attempts via log review.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in router web interface enables exploitation of public-facing application (T1190) for arbitrary OS command execution, facilitating Unix Shell usage (T1059.004).
NVD Description
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be…
more
launched remotely. The exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2026-1327 is a command injection vulnerability in the Totolink NR1800X router running firmware version 9.1.0u.6279_B20210910. The issue resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component. By manipulating the "command" argument in a POST request, an attacker can inject arbitrary commands, as classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-22.
A remote attacker with low privileges, such as an authenticated user on the device, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, allowing the injection and execution of operating system commands on the router. The scope remains unchanged, meaning the attack does not propagate beyond the targeted component.
Advisories and additional details are available from sources including VulDB (ctiid.342303, id.342303, submit.735790) and a public exploit disclosure at a Notion site. The vendor's website at totolink.net provides further context, though specific patch or mitigation guidance is referenced in these locations. The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)