CVE-2026-82616— TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow
Quick assessment
Affected
TOTOLINK NR1800X
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 TOTOLINK NR1800X 固件版本 9.1.0u.6681_B20230703 中发现了一个漏洞。受影响的函数是 文件中的 。对参数 的操作会导致基于栈的缓冲区溢出。该攻击可远程执行，且利用代码（exploit）已公开，可能已被利用。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82616
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82616
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82616
请登录查看更多情报信息。
Other References for CVE-2026-82616 (4)
-
-
🔗 CVE-2026-82616 in NR1800X third-party-advisory
-
🔗 CVE-2026-82616 TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow vdb-entry technical-description
-
IV. Related Vulnerabilities
Same product: NR1800X
-
CVE-2026-82597
TOTOLINK NR1800X cstecgi.cgi setUssd command injection -
CVE-2026-15701
Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-b -
CVE-2026-7548
Totolink NR1800X cstecgi.cgi sub_41A68C command injection -
CVE-2026-7546
Totolink NR1800X lighttpd find_host_ip stack-based overflow -
CVE-2026-5030
Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost
Same vendor: TOTOLINK
-
CVE-2026-82597
TOTOLINK NR1800X cstecgi.cgi setUssd command injection -
CVE-2026-82555
TOTOLINK N600R Authentication cstecgi.cgi loginAuth random v -
CVE-2026-82539
TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules m -
CVE-2026-79912
TOTOLINK N600R cstecgi.cgi getCurrentTime command injection -
CVE-2026-79911
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based o
Same weakness: CWE-121
-
CVE-2026-78012
Stack-based Buffer Overflow in Pyramid Solutions NetStaX Eth -
CVE-2026-12661
FactoryTalk® Historian Machine Edition - Out-of-Bounds Write -
CVE-2026-82593
D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgra -
CVE-2026-82592
D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFor -
CVE-2026-82478
NASA Trick TCP Socket JSONVariableServerThread.cpp parse_req
V. Comments for CVE-2026-82616
No comments yet