CVE-2026-36841 - Vulnerability Analysis

Overview

TOTOLINK N200RE V5 contains a command injection caused by improper sanitization of macstr and bandstr parameters in formMapDelDevice function, letting attackers execute arbitrary commands remotely, exploit requires network access.

Severity & Score

Impact

Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.

Mitigation

Update to the latest firmware version provided by TOTOLINK.

References

• https://github.com/0xmania/cve/tree/main/TOTOLINK-N200RE_V5-cstecgi-formMapDelDevice-CommandInjection

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner