TOTOLINK NR1800X CVE-2026-82597

Exploitation requires low-privilege authentication to the TOTOLINK NR1800X web management interface, as reflected by PR:L in the CVSS 4.0 vector - an attacker must hold valid credentials before sending the malicious request. The attack is network-accessible (AV:N) with no user interaction required (UI:N) once authenticated. The primary limiting factor is this authentication prerequisite; however, TOTOLINK consumer routers commonly ship with published default credentials, which in practice makes this barrier low for opportunistic attackers. No special configuration mode, non-default feature enablement, or specific platform condition beyond standard firmware operation has been identified as required. The specific confirmed vulnerable build is 9.1.0u.6681_B20230703; exploitability against other firmware builds has not been confirmed from available data.

The provided CVSS 4.0 base score of 2.1 is materially inconsistent with its own vector: AV:N (network-reachable), AC:L (no special conditions), AT:N (no attack requirements), PR:L (low privileges), and UI:N (no user interaction) should produce a significantly higher score even before considering impact. The all-Low impact ratings (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) appear substantially understated for a command injection on a router where root-level code execution is the realistic outcome - this CVSS discrepancy should be treated as an input data quality issue and verified against the vendor advisory. The E:P supplemental metric confirms public proof-of-concept availability, reducing the exploitation skill barrier. CISA KEV status is not confirmed and EPSS data was not provided, so widespread in-the-wild exploitation is unconfirmed. The authentication barrier (PR:L) provides meaningful but limited protection, given that TOTOLINK consumer devices frequently ship with default or weak credentials; in those deployments the effective exploitation barrier is very low. Net assessment: this is a genuine high-severity issue for any NR1800X device reachable from untrusted networks, despite the anomalously low CVSS score.

An attacker who has obtained valid router credentials - via default credential lookup, brute force, or credential reuse - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setUssd function, embedding shell command separators (e.g., semicolons or backticks) within the 'ussd' parameter value. The router's CGI handler passes the unsanitized argument to an OS command, executing the attacker's payload with the privileges of the web server process - typically root on embedded Linux routers. A publicly available PDF proof-of-concept on GitHub (https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totolink%20setuuid%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5.pdf) demonstrates the technique, meaning exploitation requires minimal skill.