CVE-2026-82597 in NR1800X
Summary
by MITRE • 08/31/2026
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The identified vulnerability in TOTOLINK NR1800X router firmware version 9.1.0u.6681_B20230703 represents a critical security flaw within the device management interface, specifically affecting the setUssd function located in the /cgi-bin/cstecgi.cgi script. This vulnerability is classified as a command injection issue, which falls under CWE-77: Improper Neutralization of Special Elements used in a Command. The root cause lies in the insufficient validation and sanitization of user-supplied input within the ussd argument passed to this function. When an attacker provides specially crafted data for the ussd parameter, the application fails to properly escape or filter special shell characters such as semicolons, pipes, or backticks before passing the value to a system command interpreter. This lack of neutralization allows arbitrary operating system commands to be executed with the privileges of the web server process, which on many embedded devices often includes root-level access due to legacy design choices and limited resource constraints in IoT environments.
The operational impact of this vulnerability is severe because it can be exploited remotely without requiring any form of authentication or user interaction. Attackers located anywhere on the internet who have network connectivity to the router's management interface can leverage publicly available exploit code to gain full control over the device. Once command injection is successfully executed, an attacker can perform a wide range of malicious activities including installing persistent backdoors, exfiltrating sensitive data such as Wi-Fi credentials and connected client information, pivoting into internal networks for lateral movement, or using the compromised router as part of a larger botnet infrastructure like Mirai variants. The availability of public exploits significantly lowers the barrier to entry for threat actors, increasing the likelihood of automated scanning and widespread compromise across vulnerable devices in both residential and small business environments.
From an industry standard perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving shell commands like sh or bash commonly found on Linux-based embedded systems. The attack vector corresponds to Remote Code Execution (RCE) via input validation failures, a persistent challenge in IoT device development where security is often deprioritized during firmware creation. To mitigate this risk, users should immediately update their router firmware to the latest version released by TOTOLINK if available, as vendors typically address such critical flaws through patches that implement proper input sanitization and parameter binding techniques. In cases where patching is not feasible due to hardware obsolescence or lack of vendor support, network-level mitigations are essential. These include restricting access to the management interface via VLAN segmentation, disabling remote administration features entirely, implementing strict firewall rules to block inbound traffic on ports associated with the web server (typically port 80 and 443 from untrusted networks), and monitoring for anomalous outbound connections that may indicate successful exploitation or data exfiltration attempts.