CVE-2026-79912: Command Injection in TOTOLINK N600R

This vulnerability affects TOTOLINK N600R firmware 4.3.0cu.7647_B20210106. It arises from improper handling of the ntp_server parameter in the getCurrentTime function within /cgi-bin/cstecgi.cgi, allowing an unauthenticated remote attacker to inject arbitrary commands. The vulnerability is classified under CWE-74 (Injection) and CWE-77 (Command Injection). Public exploit code exists, increasing the risk of exploitation, although no active exploitation has been confirmed. The CVSS v3.1 base score is 6.9, indicating a moderate impact with network attack vector and no privileges or user interaction required.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device without authentication. This could lead to unauthorized control of the device, potentially compromising network security and device integrity. The vulnerability impacts confidentiality, integrity, and availability at a low to moderate level as indicated by the CVSS vector components.

No official patch or remediation has been published by TOTOLINK for this vulnerability as of the current information. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting access to the device's management interface from untrusted networks and disabling remote management features where possible may reduce exposure.