The Totolink NR1800X router firmware version 9.1.0u.6279_B20210910 contains a command injection vulnerability (CVE-2026-5030) in the NTPSyncWithHost function of the Telnet Service component. By manipulating the host_time argument passed to /cgi-bin/cstecgi.cgi, an attacker can execute arbitrary commands remotely. The vulnerability has a CVSS 4.0 score of 5.3, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability is publicly disclosed but no vendor patch or mitigation guidance is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device with limited privileges. This could lead to unauthorized control or disruption of the router's operation. However, the CVSS score and vector indicate that the impact is limited by the required privileges and the vulnerability's scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Telnet service if possible or restrict access to trusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.