CVE-2026-82555: Insufficiently Random Values in TOTOLINK N600R

This vulnerability affects the loginAuth function of the /web_cste/cgi-bin/cstecgi.cgi file in TOTOLINK N600R firmware version 4.3.0cu.7866_B20220506. The issue is due to insufficient randomness in values used during authentication, potentially weakening security controls. The vulnerability can be triggered remotely but requires high attack complexity and no privileges or user interaction are needed. Although an exploit has been publicly disclosed, there is no known active exploitation in the wild. No vendor-provided patch or mitigation details are currently available.

The vulnerability could allow an attacker to compromise authentication mechanisms by exploiting insufficiently random values, potentially leading to unauthorized access or bypass of authentication controls. However, the high complexity and difficult exploitability reduce the likelihood of successful exploitation. No direct evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications for updates. Due to the high complexity and difficult exploitability, immediate urgent remediation may not be required, but affected systems should be considered at risk.