CVE-2026-9543: Totolink N300RH Web Management cstecgi.cgi setPasswordCfg OS Command Injection

Overview

CVE-2026-9543 affects the Web Management Interface of the Totolink N300RH router, specifically the setPasswordCfg function reached through /cgi-bin/cstecgi.cgi. The weakness is classified as CWE-77 (Command Injection). The record was published on 2026-05-26 by the CNA VulDB, and its NVD source status is listed as Deferred.

Impact

The record states that manipulating the admpass argument leads to OS command injection and that the attack can be executed remotely. VulDB rates the issue at CVSS 3.1 9.8 (Critical) with a vector indicating network access, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability. Successful exploitation would, in principle, allow an attacker to act with the privileges of the device's web service, which is an inference from the vulnerability class and not a confirmed detail in the record.

Affected products and versions

• Totolink N300RH, version 6.1c.1353_B20190305, is the only product and version listed in the record.
• The record does not list fixed versions, and no patch is referenced.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded in the sources consulted.
• The record states that the exploit has been publicly disclosed and may be used. A public repository is referenced in the record.
• The EPSS probability is 0.03253 (percentile 0.88059). The SSVC fields indicate exploitation at the proof-of-concept level, automatable and total technical impact.

Remediation and mitigation

• Identify all Totolink N300RH devices in the environment and confirm their firmware version.
• Because no fixed version is listed in the record, check the vendor site and VulDB for updates and consider replacing unsupported devices.
• Restrict access to the web management interface to trusted administrative networks and disable remote administration from untrusted networks.
• Change default credentials and review administrative accounts on affected devices.

Detection guidance

• Review device and network logs for unexpected administrative requests to the web management interface, particularly password-change activity.
• Monitor for unusual outbound connections or configuration changes originating from the router.
• Treat unexplained reboots, configuration resets or new administrative accounts as potential indicators of compromise.

Limitations of the available information

The record does not provide a fixed firmware version, a detailed root-cause analysis, or confirmation of which firmware builds beyond the one listed are affected. The NVD status is Deferred, and the CVSS 4.0 and 2.0 scores in the record come from different providers and are not reconciled here. Exploitation details are intentionally omitted.

Frequently asked questions

Is CVE-2026-9543 being actively exploited?

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed.

Is there a fixed version for the Totolink N300RH affected by this issue?

The record does not list any fixed version or patch. The absence of a listed fix does not confirm that none exists, so check the vendor and VulDB for updates.

What should administrators do now?

Restrict access to the web management interface, change default credentials, inventory affected devices and replace unsupported hardware if no update becomes available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.