CVE-2026-79912

🗓️ 25 Aug 2026 22:30:12Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Command injection in TOTOLINK N600R via ntp_server argument in cstecgi.cgi getCurrentTime.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-79912	26 Aug 202600:01	–	circl
Cvelist	CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection	25 Aug 202622:30	–	cvelist
EUVD	EUVD-2026-66186	26 Aug 202600:31	–	euvd
NVD	CVE-2026-79912	25 Aug 202623:17	–	nvd
Positive Technologies	PT-2026-81900	25 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-79912: Improper Neutralization of Special Elements used in a Command	25 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection	25 Aug 202622:30	–	vulnrichment

Vulners

Node

totolink n600rMatch4.3.0cu.7647_b20210106

[
  {
    "vendor": "TOTOLINK",
    "product": "N600R",
    "versions": [
      {
        "version": "4.3.0cu.7647_B20210106",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:totolink:n600r_firmware:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/395062/cti
vuldb	www.vuldb.com/cve/CVE-2026-79912
totolink	www.totolink.net/
vuldb	www.vuldb.com/vuln/395062
github	www.github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TOTOLINK_N600R_cstecgi_Time_WiFi_Service_popen_Command_Injection.md
vuldb	www.vuldb.com/submit/881261

Parameter	Position	Path	Description	CWE
ntp_server	query param	/cgi-bin/cstecgi.cgi	Remote command injection through the ntp_server parameter in /cgi-bin/cstecgi.cgi on TOTOLINK N600R (version 4.3.0cu.7647_B20210106).	CWE-74, CWE-77

26 Aug 2026 16:19Current

7.5High risk

Vulners AI Score7.5

CVSS 46.9

CVSS 27.5

CVSS 3.18.3

CVSS 38.3

EPSS0.02109

SSVC