CVE-2026-82555

LowCVSS 3.7/10Last modified Aug 31, 2026

Description

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-310 CWE-330

Affected software

Vendor	Product	Versions
TOTOLINK	N600R	4.3.0cu.7866_B20220506

References

Timeline

Published: Aug 30, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-825566.3A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is CVE-2026-825576.9Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the reque CVE-2026-825582.3Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket suppor CVE-2026-825592.3Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket CVE-2026-82562.4A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accou CVE-2026-825607.5Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to CVE-2026-825616.5Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow d CVE-2026-825623.7### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push k CVE-2026-825637.6An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation CVE-2026-825647.1Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to updat CVE-2026-825668.8The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the CVE-2026-825676.3The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The