CVE-2026-82555
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Vulnerability in TOTOLINK N600R in the loginAuth function of cstecgi.cgi leads to insufficiently random values. Remote attack is possible but has high complexity and difficulty.
Risk Assessment
Insufficient randomness may allow an attacker to predict authentication values, potentially leading to unauthorized access.
Recommendation
Apply vendor patches or restrict device access to reduce risk.
Other vulnerabilities in TOTOLINK N600R
See all- CVE-2026-79911Critical
TOTOLINK N600R 4.3.0cu.7647_B20210106 has a stack-based buffer overflow vulnerability in the setSystemConfig function of /cgi-bin/cstecgi.cgi. Manipulation of the Hostname argument leads to buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.
- CVE-2025-51390Critical
A command injection vulnerability was discovered in the TOTOLINK N600R router running firmware version V4.3.0cu.7647_B20210106. The issue resides in the setWiFiWpsConfig function via the pin parameter.
- CVE-2025-46060Critical
A buffer overflow vulnerability was found in the TOTOLINK N600R router firmware version 4.3.0cu.7866_B2022506. A remote attacker can exploit the UPLOAD_FILENAME component to execute arbitrary code.
- CVE-2026-79912High
A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
- CVE-2025-60335High
A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2025-11444High
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506 in the setWiFiBasicConfig function of the /cgi-bin/cstecgi.cgi file in the HTTP Request Handler component. Manipulation of the wepkey argument leads to buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAuth of the file /web_cste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS