Security readout for executives and security teams
Plain-English summary
CVE-2026-1156 is a critical buffer overflow in Totolink LR350 firmware version 9.3.5u.6369_B20220309. A remote authenticated attacker could potentially compromise the router through Wi-Fi configuration handling. Public exploit material is reported, but the provided sources do not show confirmed active exploitation or a vendor fix.
Executive priority
Treat as urgent for any deployed LR350 router matching the affected firmware. Public exploit disclosure raises risk, but authentication is required and active exploitation is not confirmed. Prioritize exposure reduction and vendor update tracking.
Technical view
The flaw affects /cgi-bin/cstecgi.cgi in the setWiFiBasicCfg function. Manipulation of the ssid argument can trigger a buffer overflow. VulDB lists CWE-119/CWE-120 and CVSS 2.0 score 9.0 with network access, low complexity, and single authentication required.
Likely exposure
Exposure is most relevant for Totolink LR350 devices running firmware 9.3.5u.6369_B20220309, especially where router management interfaces are reachable by untrusted users or weakly protected credentials are used.
Exploitation context
The source bundle states remote attack is possible and exploit details have been publicly disclosed. CVSS indicates authentication is required. CISA KEV status is false in the provided data, so active exploitation is not confirmed here.
Researcher notes
Evidence is primarily from CVE/VulDB records and a linked public exploit write-up. The provided sources do not name a patched firmware version. Avoid assuming broader Totolink product impact beyond LR350 9.3.5u.6369_B20220309.
Mitigation direction
- Identify Totolink LR350 devices and confirm firmware versions.
- Check Totolink guidance for firmware updates or advisories.
- Restrict router management access to trusted networks only.
- Disable remote administration if not required.
- Use strong, unique administrator credentials.
- Replace unsupported or unpatchable exposed devices.
Validation and detection
- Inventory LR350 routers across offices, labs, and remote sites.
- Confirm whether firmware matches 9.3.5u.6369_B20220309.
- Verify management interfaces are not internet-exposed.
- Review access logs for unusual cstecgi.cgi configuration activity.
- Monitor vendor and VulDB pages for update status.
- Document compensating controls for any affected device.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1156 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341750 | Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowCVE reference · vdb-entry, technical-description
- VDB-341750 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- Submit #735722 | TOTOLINK LR350 LR350 V9.3.5u.6369_B20220309 Buffer OverflowCVE reference · third-party-advisory
- https://lavender-bicycle-a5a.notion.site/TOTOLINK-LR350-setWiFiBasicCfg-2e453a41781f80a2ad43e85bf5d46659?source=copy_linkCVE reference · exploit
- https://www.totolink.net/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.