What is the CVSS score of EUVD-2026-16971?

EUVD-2026-16971 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 2.9%.

Is there a public PoC exploit available for EUVD-2026-16971?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16971. Prioritise patching immediately. EPSS: 2.9%.

How to fix or mitigate EUVD-2026-16971?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Nr1800X EUVD-2026-16971

| CVE-2026-5030 LOW

Command Injection (CWE-77)

2026-03-29 VulDB

Command Injection Nr1800X TOTOLINK

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 6.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates network-accessible attack requiring low privileges (PR:L), no user interaction, and limited confidentiality/integrity/availability impact. The E:P (exploit code maturity: proof-of-concept) reflects publicly disclosed exploit code. EPSS probability appears moderate based on the standard remediation and reporting context (RL:X suggests unknown/unspecified remediation level). However, the PR:L authentication requirement significantly reduces real-world risk compared to unauthenticated vectors-attackers must first compromise or guess valid credentials. The vulnerability affects a specific router model with a narrowly scoped firmware version, further limiting exposure compared to broadly distributed appliances. SSVC context: exploitation is probable (POC exists), but automatable only if default/weak credentials are present, and technical impact is moderate (command execution on router, potential network compromise but not critical infrastructure in most deployments).
Exploit ScenarioDerived	An authenticated attacker with valid router credentials accesses the web interface or CGI endpoint and sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with a malicious host_time parameter containing shell command injection payloads (e.g., host_time=value;id;). The NTPSyncWithHost function fails to sanitize the input and passes it directly to a shell command, resulting in execution of arbitrary commands with the privileges of the CGI process (typically router admin/root). Publicly available proof-of-concept code lowers the barrier for exploitation, though initial credential compromise or default password guessing remains necessary.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 2.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 29, 2026

Command injection in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary commands via the host_time parameter in the NTPSyncWithHost function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with publicly available exploit code, though it requires valid login credentials to exploit. Real-world risk is moderate given the authentication requirement and moderate EPSS probability (indicated by E:P in vector).

RemediationAI

Primary remediation is to update Totolink NR1800X firmware to the latest available version released by the vendor after the vulnerability disclosure. Users should check https://www.totolink.net/ for official firmware updates. In the interim, mitigate by restricting network access to the router's management interface (CGI services), disable remote management/Telnet access if not required, and use strong, unique credentials for router administration. Monitor router logs for suspicious CGI requests to /cgi-bin/cstecgi.cgi with host_time parameter manipulation. If patch availability is uncertain, contact Totolink support directly for advisory and timeline.

Affected VersionsENISA

NR1800X 9.1.0u.6279_B20210910

Affected Packages

euvd nr1800x no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the Telnet Service component of Totolink NR1800X routers, specifically within the NTPSyncWithHost CGI function. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning user-supplied input in the host_time parameter is passed unsanitized to a system command execution routine. The /cgi-bin/cstecgi.cgi endpoint processes this parameter without adequate input validation or escaping, allowing shell metacharacters to be injected. This is a classic command injection vulnerability affecting network device firmware where CGI scripts often have direct access to system shell execution functions.

Know when Nr1800X gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 19:00 vuln.today

Public exploit code

CVE Published

Mar 29, 2026 - 03:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument host_time leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-5030, a command injection vulnerability rated CVSS 5.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.

Threat Intelligence Overview

EPSS Score

2.9%

Top 14% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 2.9%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.