CVE-2026-5030 is a critical command injection vulnerability affecting Totolink NR1800X firmware version 9.1.0u.6279_B20210910. This flaw in the Telnet Service's NTPSyncWithHost function allows an unauthenticated, remote attacker to execute arbitrary commands by manipulating the 'host_time' argument. With a CVSS score of 9.8, it poses a severe risk of complete system compromise due to its low attack complexity and lack of required user interaction. While not currently observed in active exploitation, public exploit code has been disclosed, indicating a high potential for future attacks. Organizations using affected Totolink devices should prioritize patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
9.1.0u.6279_b20210910CPE matchmatch criteria | cpe:2.3:o:totolink:nr1800x_firmware:9.1.0u.6279_b20210910:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.