CVE-2026-79912

Deferred Deferred - Pending Action

Command Injection in TOTOLINK N600R Router

Publication date: 2026-08-25

Last updated on: 2026-08-26

Assigner: VulDB

Description

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-26

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-79912

EUVD

EUVD-2026-66186

Affected Vendors & Products

Vendor	Product	Version / Range
totolink	n600r	4.3.0cu.7647_b20210106

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in TOTOLINK N600R version 4.3.0cu.7647_B20210106. It exists in the getCurrentTime function of the file /cgi-bin/cstecgi.cgi. An attacker can exploit this by manipulating the ntp_server argument to inject malicious commands. The attack can be executed remotely without authentication.

Detection Guidance

This vulnerability involves command injection via the ntp_server parameter in TOTOLINK N600R devices. To detect it, check for unusual network traffic or requests to /cgi-bin/cstecgi.cgi with manipulated ntp_server values. Inspect logs for suspicious commands or unexpected system behavior.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected device. This could lead to unauthorized access, data theft, or disruption of network services. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability allows remote command injection via manipulation of the ntp_server argument in the TOTOLINK N600R device. Such unauthorized remote access could lead to data breaches, unauthorized data access, or modification, which are critical violations under GDPR and HIPAA. Compliance with these regulations requires robust security controls to prevent unauthorized access and data exposure.

Mitigation Strategies

Immediately update the TOTOLINK N600R firmware to the latest version to patch the command injection vulnerability in the getCurrentTime function. If no update is available, consider isolating the device from the network or disabling remote access to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-79912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70