CVE-2026-9543

Vulnerability

An OS command injection vulnerability exists in the setPasswordCfg function of the web management interface (/cgi-bin/cstecgi.cgi) on Totolink N300RH routers running firmware version 6.1c.1353_B20190305. The admpass parameter is not properly sanitized, allowing injection of arbitrary system commands. No authentication is required to reach this endpoint [1].

Exploitation

An attacker can send a crafted HTTP request to the vulnerable endpoint with the admpass parameter containing command injection payloads (e.g., using backticks or shell metacharacters). The exploit is publicly available and does not require any prior authentication or user interaction [1].

Impact

Successful exploitation results in remote code execution (RCE) as the root user, giving the attacker full control over the device. This can lead to complete compromise of network traffic, data exfiltration, or use of the router in botnets [1].

Mitigation

As of the publication date (2026-05-26), no official patch has been released by Totolink. Users are advised to isolate the router from untrusted networks or replace it with a supported model. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].