CVE-2026-1149

published 2026-01-19

CVE-2026-1149: A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the…

low 2.1 CVSS 4.0

AV N AC L AT N PR L UI N VC L VI L VA L SC N SI N SA N E P CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
linux	linux_kernel	>= 3.8.0 < 6.18.13	6.18.13
linux	linux_kernel	>= 6.19.0 < 6.19.3	6.19.3
totolink	lr350	—	—
totolink	lr350_firmware	—	—

CWE-74 CWE-77