TOTOLINK NR1800X Firmware 9.1.0u.6279 B20210910

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6279_b20210910:*:*:*:*:*:*:*

part: o version: 9.1.0u.6279_b20210910 update: *

VendorTotolink (fa0129e6-aa24-5784-be77-22d8becdb79b)
ProductNr1800X Firmware (1f55f5e5-6988-5b98-a2ed-d71ce843675c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-5030 vulnerable 2026-06-08 08:07:02.900705 Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection
MEDIUM (6.3)
A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-29T03:30:15.254Z
Updated: 2026-03-30T13:28:48.091Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-1328 vulnerable 2026-06-08 07:49:08.277979 Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow
HIGH (8.8)
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Published: 2026-01-22T14:32:13.191Z
Updated: 2026-02-23T08:53:16.410Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-1327 vulnerable 2026-06-08 07:49:08.277549 Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection
MEDIUM (6.3)
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-01-22T14:02:10.294Z
Updated: 2026-02-23T08:53:00.325Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-1326 vulnerable 2026-06-08 07:49:08.275908 Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection
MEDIUM (6.3)
A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-01-22T13:32:08.210Z
Updated: 2026-02-23T08:52:44.721Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-7220 vulnerable 2026-06-08 06:21:57.318236 Totolink NR1800X cstecgi.cgi loginAuth stack-based overflow
CRITICAL (9.8)
A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2024-01-09T07:31:03.195Z
Updated: 2025-06-17T20:39:18.356Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-36340 vulnerable 2026-06-08 06:06:28.720878 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41528 vulnerable 2026-06-08 05:48:30.455308 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41527 vulnerable 2026-06-08 05:48:30.454871 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41526 vulnerable 2026-06-08 05:48:30.454629 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41525 vulnerable 2026-06-08 05:48:30.454382 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41524 vulnerable 2026-06-08 05:48:30.454124 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41523 vulnerable 2026-06-08 05:48:30.453869 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41522 vulnerable 2026-06-08 05:48:30.453626 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41521 vulnerable 2026-06-08 05:48:30.453365 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41520 vulnerable 2026-06-08 05:48:30.453096 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41518 vulnerable 2026-06-08 05:48:30.452708 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-41517 vulnerable 2026-06-08 05:48:30.451748 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.