CVE-2026-1327

CWE-74CWE-77 — Command InjectionCWE-1327CWE-284 — Improper Access Control6 documents5 sources
Severity
5.3MEDIUM
EPSS
0.5%
top 32.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink Nr1800xTotolink Nr1800x Firmware
Timeline
PublishedJan 22
Latest updateMar 9

Description

A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/nr1800x9.1.0u.6279_B20210910
▶NVDtotolink/nr1800x_firmware9.1.0u.6279_b20210910

🔴Vulnerability Details

4
GHSA
Apache IoTDB has an Insecure Default Configuration Vulnerability↗2026-03-09
▶
GHSA
OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback↗2026-02-17
▶
CVEList
Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection↗2026-01-22
▶
GHSA
GHSA-vcr6-rc5m-f5w2: A security vulnerability has been detected in Totolink NR1800X 9↗2026-01-22
▶

📋Vendor Advisories

1
Microsoft
Azure IoT Explorer Information Disclosure Vulnerability↗2026-02-10
▶
CVE-2026-1327 (MEDIUM CVSS 5.3) | A security vulnerability has been d | cvebase.io