Loading story…
High-severity vulnerabilities have been disclosed in two consumer router lines, enabling remote operating system command injection through web-facing configuration functions. CVE-2026-4558 affects the Linksys MR9600 running firmware 2.0.6.206937, where the smartConnectConfigure function in SmartConnect.lua can be abused by manipulating configApSsid, configApPassphrase, srpLogin, or srpPassword. The flaw is classified under CWE-78 and CWE-77, carries high impact to confidentiality, integrity, and availability, and the disclosure says a public exploit exists and may already be used in the wild. The report also states that Linksys was contacted before publication but did not respond.
A separate issue, CVE-2026-4611, affects TOTOLINK X6000R devices on firmware 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. In that case, the setLanCfg function within /usr/sbin/shttpd allows remote command injection via the Hostname argument, creating a path to privilege escalation and full device compromise. Like the Linksys flaw, the TOTOLINK bug is mapped to CWE-78 and CWE-77 and is rated high severity across published scoring, underscoring continued risk from insecure input handling in router administration components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A remote OS command injection vulnerability in the setLanCfg function of /usr/sbin/shttpd was recorded for TOTOLINK X6000R firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. The issue, triggered through the Hostname argument, was received by cna@vuldb.com and published with high-severity impact ratings.
A vulnerability affecting Linksys MR9600 firmware 2.0.6.206937 was disclosed, involving OS command injection in the SmartConnect.lua smartConnectConfigure function via parameters including configApSsid, configApPassphrase, srpLogin, and srpPassword. The disclosure noted high impact and said an exploit had been published, while also stating Linksys had been contacted earlier but did not respond.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceopenwrt.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity command injection vulnerabilities have been disclosed in the **Totolink A3300R** router, both affecting firmware version `17.0.0cu.557_b20221024` and exposing the device to remote code execution through `/cgi-bin/cstecgi.cgi`. The flaws are tracked as **`CVE-2026-5104`** and **`CVE-2026-5101`**. `CVE-2026-5104` affects the `setStaticRoute` function, where manipulation of the `ip` argument can trigger command injection, while `CVE-2026-5101` affects the `setLanCfg` function in the Parameter Handler component through the `lanIp` argument. Public exploit material has been disclosed for both issues, according to VulDB and referenced advisory material, raising the risk of active abuse against exposed devices. NVD subsequently added initial analysis for the CVEs, assigning higher **CVSS v3.1** severity assessments than the original CNA submissions and mapping the weaknesses to **`CWE-77`**, **`CWE-74`**, and **`CWE-78`**. The disclosures indicate that attackers could remotely inject operating system commands via crafted requests, making patching, exposure reduction, and monitoring of internet-facing Totolink A3300R systems urgent priorities.
Jun 29, 2026
Two Totolink router models, **A7100RU** and **A8000RU**, were disclosed with critical OS command injection vulnerabilities in the CGI handler endpoint `/cgi-bin/cstecgi.cgi`. The flaws affect the `setVpnPassCfg` function and stem from improper handling of the `pptpPassThru` argument, allowing attackers to inject operating system commands remotely. The issues were assigned **CVE-2026-5850** for the A7100RU running firmware `7.4cu.2313_b20191024` and **CVE-2026-7037** for the A8000RU running firmware `7.1cu.643_b20200521`. Both vulnerabilities are classified under **CWE-78** and **CWE-77**, and were reported as remotely exploitable without privileges or user interaction. The disclosures indicate that **public exploits are available**, materially raising the risk of opportunistic compromise of exposed devices. Severity scoring across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** places the flaws at critical or maximum-impact levels, making internet-facing Totolink routers running the affected firmware high-priority targets for remediation or isolation.
Jun 29, 2026
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026