CVE-2026-82555— TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
Quick assessment
Affected
TOTOLINK N600R
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在TOTOLINK N600R 4.3.0cu.7866_B20220506中发现一个漏洞。该漏洞影响认证处理组件中文件/web_cste/cgi-bin/cstecgi.cgi内的loginAuth函数。这种操作会导致随机值生成不充分。攻击者可以远程发动攻击。该攻击的特点是复杂度较高。其可利用性较难实现。该漏洞已被公开披露，并可能已被利用。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82555
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不充分的随机数
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82555
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82555
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82555 (2)
-
🔗 CVE-2026-82555 TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values vdb-entry technical-description
-
Proof of Concept for CVE-2026-82555 (2)
Security Blog Posts for CVE-2026-82555 (1)
-
🔗 CVE-2026-82555 in N600R third-party-advisory
IV. Related Vulnerabilities
Same product: N600R
-
CVE-2026-79912
TOTOLINK N600R cstecgi.cgi getCurrentTime command injection -
CVE-2026-79911
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based o -
CVE-2025-11444
TOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig b -
CVE-2025-9935
TOTOLINK N600R cstecgi.cgi sub_4159F8 command injection -
CVE-2025-8181
TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privileg
Same vendor: TOTOLINK
-
CVE-2026-82539
TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules m -
CVE-2026-79912
TOTOLINK N600R cstecgi.cgi getCurrentTime command injection -
CVE-2026-79911
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based o -
CVE-2026-75013
TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer deref -
CVE-2026-75012
TOTOLINK EX1200L Password Configuration cstecgi.cgi setPassw
Same weakness: CWE-330
-
CVE-2026-19485
Bucket Squatting in Vertex AI Search for Commerce -
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask -
CVE-2026-19896
mangroup dtale Flask Session Cookie app.py build_secret_key -
CVE-2026-18531
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 -
CVE-2026-71225
Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chu
V. Comments for CVE-2026-82555
No comments yet