A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. (CVE-2026-82597)

The TOTOLINK NR1800X device running firmware 9.1.0u.6681_B20230703 contains a command injection vulnerability (CVE-2026-82597) in the setUssd function within /cgi-bin/cstecgi.cgi. An attacker with network access and low privileges can remotely manipulate the 'ussd' parameter to inject and execute arbitrary system commands. This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Public exploit code exists, but no active exploitation is currently known. No official patch or vendor advisory is available at this time.

Successful exploitation allows remote attackers with low privileges to execute arbitrary commands on the affected device, potentially compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized control over the device and disruption of its normal operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the device's management interfaces and monitor for suspicious activity related to the 'ussd' parameter. Avoid exposing the device management interface to untrusted networks.