CVE-2026-1150

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
Totolink	LR350	9.3.5u.6369_B20220309

References

https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setTracerouteCfg-2e453a41781f803494e3e4161a393487?source=copy_linkExploit, Third Party Advisory
https://vuldb.com/?ctiid.341743Permissions Required, VDB Entry
https://vuldb.com/?id.341743Third Party Advisory, VDB Entry
https://vuldb.com/?submit.735696Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-115005.0A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/au CVE-2026-115017.3A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown proce CVE-2026-115023.1A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-CVE-2026-115038.8A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of th CVE-2026-115048.8A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi CVE-2026-115055.0A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of CVE-2026-115066.3A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_fo CVE-2026-115076.3A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php CVE-2026-115086.3A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the f CVE-2026-115096.3A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /a CVE-2026-11515.4A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center CVE-2026-115106.3A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php.