Details of VAR-202601-2425

ID

VAR-202601-2425

CVE

CVE-2026-1328

TITLE

TOTOLINK of nr1800x Multiple vulnerabilities in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2026-002451

DESCRIPTION

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. This exploit is now publicly available and can be exploited in the wild.All information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software

Trust: 1.62

sources: NVD: CVE-2026-1328 // JVNDB: JVNDB-2026-002451

AFFECTED PRODUCTS

vendor:	totolink	model:	nr1800x	scope:	eq	version:	9.1.0u.6279_b20210910	Trust: 1.0
vendor:	totolink	model:	nr1800x	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	nr1800x	scope:	eq	version:	nr1800x firmware 9.1.0u.6279_b20210910	Trust: 0.8
vendor:	totolink	model:	nr1800x	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2026-002451 // NVD: CVE-2026-1328

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2026-1328
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2026-002451
value:	HIGH
Trust: 0.8

cna@vuldb.com:	CVE-2026-1328
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2026-002451
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2026-1328
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2026-002451
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2026-002451 // NVD: CVE-2026-1328

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.0
problemtype:	CWE-119	Trust: 1.0
problemtype:	Buffer error (CWE-119) [ others ]	Trust: 0.8
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2026-002451 // NVD: CVE-2026-1328

PATCH

title:

//vuldb.com/?submit.735792

url:

https://lavender-bicycle-a5a.notion.site/TOTOLINK-NR1800X-setWizardCfg-2e453a41781f80568a54c9368082fbe9?source=copy_link

Trust: 0.8

sources: JVNDB: JVNDB-2026-002451

EXTERNAL IDS

db:	NVD	id:	CVE-2026-1328	Trust: 2.6
db:	VULDB	id:	342304	Trust: 1.0
db:	JVNDB	id:	JVNDB-2026-002451	Trust: 0.8

sources: JVNDB: JVNDB-2026-002451 // NVD: CVE-2026-1328

REFERENCES

url:	https://www.totolink.net/	Trust: 1.8
url:	https://vuldb.com/?submit.735792	Trust: 1.0
url:	https://vuldb.com/?ctiid.342304	Trust: 1.0
url:	https://lavender-bicycle-a5a.notion.site/totolink-nr1800x-setwizardcfg-2e453a41781f80568a54c9368082fbe9?source=copy_link	Trust: 1.0
url:	https://vuldb.com/?id.342304	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2026-1328	Trust: 0.8

sources: JVNDB: JVNDB-2026-002451 // NVD: CVE-2026-1328

SOURCES

db:	JVNDB	id:	JVNDB-2026-002451
db:	NVD	id:	CVE-2026-1328

LAST UPDATE DATE

2026-02-03T23:34:42.850000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2026-002451	date:	2026-02-02T10:37:00
db:	NVD	id:	CVE-2026-1328	date:	2026-01-29T17:47:56.127

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2026-002451	date:	2026-02-02T00:00:00
db:	NVD	id:	CVE-2026-1328	date:	2026-01-22T15:16:51.173