TOTOLINK NR1800X CVE-2026-82616

Exploitation requires network-level access to the TOTOLINK NR1800X web management interface (HTTP or HTTPS) and a low-privilege authenticated session, as indicated by PR:L in the CVSS 4.0 vector. The setUploadSetting function in /cgi-bin/cstecgi.cgi must be reachable - this endpoint is part of the default management interface enabled on LAN-facing ports. No special non-default configuration is required beyond having the web interface running, which is the default state. Exploitation is limited by the authentication requirement: a valid session token or credentials are needed. This barrier is practically reduced by the prevalence of default credentials on TOTOLINK devices. Fully unauthenticated exploitation (PR:N) is not indicated by the available CVSS data. WAN-side exposure would require remote management to be explicitly enabled.

The CVSS 4.0 score of 8.6 with an E:P threat metric (exploit publicly available) reflects a serious, practically exploitable vulnerability. The attack vector is network-based (AV:N), complexity is low (AC:L), and no user interaction is required (UI:N), making this amenable to scripted exploitation. The PR:L metric indicates that some authenticated session is required, which is the primary mitigating factor in the score - however, TOTOLINK devices commonly ship with default or weak credentials, rendering this barrier minimal in practice. Both vulnerable-system and subsequent-system impacts are rated High across confidentiality, integrity, and availability in the CVSS 4.0 vector, consistent with full gateway compromise. The public POC on GitHub significantly elevates real-world risk; any operator running this firmware who has management access exposed, even on the LAN, faces a credible threat. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be independently quantified. No vendor patch has been identified in the provided references, leaving compensating controls as the only current mitigation path. Even a mid-sized municipal IT team or SOHO operator should treat this as urgent given the combination of public exploit and absent patch.

An attacker who has obtained low-privilege credentials - likely through default credential reuse or credential stuffing - sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with an oversized FileName value targeting the setUploadSetting function. The stack buffer overflow overwrites the saved return address, redirecting execution to attacker-supplied shellcode or a ROP chain, achieving code execution at the privilege level of the CGI process (typically root on embedded devices). The publicly available proof-of-concept PDF on GitHub documents this technique in sufficient detail to lower the skill threshold for exploitation.