CVE-2026-5030
Published: 29 March 2026
Summary
CVE-2026-5030 is a medium-severity Injection (CWE-74) vulnerability in Totolink Nr1800X Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-5030 is a command injection vulnerability affecting the Totolink NR1800X router on firmware version 9.1.0u.6279_B20210910. The issue resides in the NTPSyncWithHost function of the /cgi-bin/cstecgi.cgi file within the Telnet Service component, where manipulation of the host_time argument enables command injection. Published on 2026-03-29, it is associated with CWEs-74 and CWE-77 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an attacker with low privileges (PR:L), requiring low attack complexity and no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through injected commands.
Advisories and additional details, including public exploit disclosure, are available via references such as VulDB entries (vuldb.com/vuln/353952), a proof-of-concept at a Notion site, and the vendor site at www.totolink.net. The exploit has been disclosed to the public and may be used.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16971
Vulnerability details
A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router CGI enables exploitation of public-facing application (T1190) and execution of commands via network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by requiring validation of the untrusted host_time input to the NTPSyncWithHost function in cstecgi.cgi.
Mandates timely remediation of the specific command injection flaw in the Totolink NR1800X firmware to eliminate the vulnerability.
Enables detection of the command injection vulnerability through regular vulnerability scanning of the affected router firmware.