CVE-2026-1150

CWE-74CWE-77 — Command Injection3 documents3 sources
Severity
5.3MEDIUM
EPSS
2.1%
top 15.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink Lr350Totolink Lr350 Firmware
Timeline
PublishedJan 19

Description

A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/lr3509.3.5u.6369_B20220309
▶NVDtotolink/lr350_firmware9.3.5u.6369_b20220309

🔴Vulnerability Details

2
GHSA
GHSA-fv3r-wg9g-8ggf: A security flaw has been discovered in Totolink LR350 9↗2026-01-19
▶
CVEList
Totolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection↗2026-01-19
▶
CVE-2026-1150 (MEDIUM CVSS 5.3) | A security flaw has been discovered | cvebase.io