CVE-2026-82597: Command Injection in TOTOLINK NR1800X

This vulnerability affects TOTOLINK NR1800X firmware version 9.1.0u.6681_B20230703. The issue is a command injection in the setUssd function of the /cgi-bin/cstecgi.cgi endpoint. By manipulating the 'ussd' parameter, an attacker can remotely execute arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and requires low attack complexity. Although exploit code is publicly available, there is no vendor advisory or patch information currently available, and the remediation level is unknown.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the router. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of compromise. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the device's management interface and monitor for suspicious activity related to the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device to untrusted networks.